PT-2025-53643 · Zkteco · Zkteco Biotime

Luca_Irinel + 1 · Published 2025-12-28 · Updated 2025-12-28 · CVE-2025-15128

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime versions 9.0.3 through 9.0.4 ZKTeco BioTime version 9.5.2

Description A security issue exists in ZKTeco BioTime related to the storage of credentials. Manipulation of the backup encryption password decrypt/export encryption password decrypt argument within the Endpoint component, specifically concerning the file /base/safe setting/, can lead to unprotected storage of credentials. Remote exploitation is possible. The exploit is publicly available. The vendor was contacted regarding this issue but did not respond.

Recommendations ZKTeco BioTime versions 9.0.3 and 9.0.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. ZKTeco BioTime version 9.5.2: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-255

CWE-256

Related Identifiers

CVE-2025-15128

Affected Products

Zkteco Biotime

References · 9

• 🔥 https://github.com/ionutluca888/IDOR-POC-ZKBio-Time/tree/main · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-15128 · Security Note
• https://twitter.com/VulmonFeeds/status/2005222021379018809 · Twitter Post
• https://twitter.com/CVEnew/status/2005199343133876499 · Twitter Post
• https://vuldb.com/?submit.711813 · Note
• https://vuldb.com/?id.338506 · Note
• https://t.me/cveNotify/146966 · Telegram Post
• https://t.me/CVEtracker/40764 · Telegram Post
• https://vuldb.com/?ctiid.338506 · Note