PT-2025-32981 · Zkteco · Zkteco Wl20

Published 2025-08-13 · Updated 2025-08-13 · CVE-2025-55279

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: ZKTeco WL20 (affected versions not specified)

Description: The device stores a private key in plaintext within its firmware. An attacker with physical access can extract the firmware, analyze the binary data, and retrieve the private key. Successful exploitation could allow an attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2025-55279

Affected Products

Zkteco Wl20

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-55279 · Security Note
• https://twitter.com/CVEnew/status/1955658257239834759 · Twitter Post
• https://t.me/cveNotify/132026 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172 · Note
• https://twitter.com/VulmonFeeds/status/1955618758615040322 · Twitter Post