# cve.now: ZKTeco

The newest entries naming ZKTeco as an affected vendor (up to 200), of 37 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108798](https://cve.now/CVE-2026-108798.md): ZKTeco BioTime hard-coded key (CVSS 6.9)
- [CVE-2026-108797](https://cve.now/CVE-2026-108797.md): ZKTeco BioTime Employee REST API employees authorization (CVSS 5.3)
- [CVE-2026-108796](https://cve.now/CVE-2026-108796.md): ZKTeco BioTime Biometric Data Endpoint finger\_data authorization (CVSS 5.3)
- [CVE-2026-108795](https://cve.now/CVE-2026-108795.md): ZKTeco BioTime System Settings API systemSettings access control (CVSS 5.3)
- [CVE-2026-108794](https://cve.now/CVE-2026-108794.md): ZKTeco BioTime Database Migration Functionality db\_migrate\_setting sql injection (CVSS 5.3)
- [CVE-2026-8598](https://cve.now/CVE-2026-8598.md): Unauthenticated Export Service in ZKTeco CCTV Cameras (CVSS 9.1)
- [CVE-2016-20032](https://cve.now/CVE-2016-20032.md): ZKTeco ZKAccess Security System 5.3.1 Stored XSS (CVSS 5.1)
- [CVE-2016-20031](https://cve.now/CVE-2016-20031.md): ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp (CVSS 6.8)
- [CVE-2016-20030](https://cve.now/CVE-2016-20030.md): ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction (CVSS 9.3)
- [CVE-2016-20029](https://cve.now/CVE-2016-20029.md): ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability (CVSS 6.9)
- [CVE-2016-20028](https://cve.now/CVE-2016-20028.md): ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin (CVSS 5.3)
- [CVE-2016-20027](https://cve.now/CVE-2016-20027.md): ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities (CVSS 5.1)
- [CVE-2016-20026](https://cve.now/CVE-2016-20026.md): ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution (CVSS 9.3)
- [CVE-2016-20025](https://cve.now/CVE-2016-20025.md): ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions (CVSS 8.7)
- [CVE-2016-20024](https://cve.now/CVE-2016-20024.md): ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation (CVSS 9.3)
- [CVE-2025-15128](https://cve.now/CVE-2025-15128.md): ZKTeco BioTime Endpoint safe\_setting credentials storage (CVSS 6.9)
- [CVE-2025-55280](https://cve.now/CVE-2025-55280.md): Information Disclosure Vulnerability in ZKTeco WL20 (CVSS 5.2)
- [CVE-2025-55279](https://cve.now/CVE-2025-55279.md): Hard-coded Private Key Vulnerability in ZKTeco WL20 (CVSS 6.9)
- [CVE-2025-54465](https://cve.now/CVE-2025-54465.md): Hard-coded Credentials Vulnerability in ZKTeco WL20 (CVSS 6.8)
- [CVE-2025-54464](https://cve.now/CVE-2025-54464.md): Cleartext Storage Vulnerability in ZKTeco WL20 (CVSS 7.0)
- [CVE-2024-13966](https://cve.now/CVE-2024-13966.md): ZKTeco BioTime default password (CVSS 7.3)
- [CVE-2025-45746](https://cve.now/CVE-2025-45746.md): In ZKT ZKBio CVSecurity 6.4.1\_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service co (CVSS 6.5)
- [CVE-2024-11049](https://cve.now/CVE-2024-11049.md): ZKTeco ZKBio Time Image File photo direct request (CVSS 6.3)
- [CVE-2024-45250](https://cve.now/CVE-2024-45250.md): ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor (CVSS 4.3)
- [CVE-2024-6523](https://cve.now/CVE-2024-6523.md): ZKTeco BioTime system-group-add cross site scripting (CVSS 5.3)
- [CVE-2024-6344](https://cve.now/CVE-2024-6344.md): ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting (CVSS 4.8)
- [CVE-2024-6006](https://cve.now/CVE-2024-6006.md): ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting (CVSS 5.1)
- [CVE-2024-6005](https://cve.now/CVE-2024-6005.md): ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting (CVSS 5.1)
- [CVE-2023-3943](https://cve.now/CVE-2023-3943.md): Multiple buffer overflow in ZkTeco-based OEM devices (CVSS 10.0)
- [CVE-2023-3942](https://cve.now/CVE-2023-3942.md): Multiple SQLi in ZkTeco-based OEM devices (CVSS 7.5)
- [CVE-2023-3941](https://cve.now/CVE-2023-3941.md): Multiple arbitrary file writes in ZkTeco-based OEM devices (CVSS 10.0)
- [CVE-2023-3940](https://cve.now/CVE-2023-3940.md): Multiple arbitrary file reads in ZkTeco-based OEM devices (CVSS 7.5)
- [CVE-2023-3939](https://cve.now/CVE-2023-3939.md): Multiple command injection in ZkTeco-based OEM devices (CVSS 10.0)
- [CVE-2023-3938](https://cve.now/CVE-2023-3938.md): Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code (CVSS 4.6)
- [CVE-2024-2318](https://cve.now/CVE-2024-2318.md): ZKTeco ZKBio Media Service Port 9999 download path traversal (CVSS 5.3)
- [CVE-2024-1706](https://cve.now/CVE-2024-1706.md): ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting (CVSS 5.1)
- [CVE-2023-4587](https://cve.now/CVE-2023-4587.md): Insecure direct object reference in ZKTeco ZEM800 (CVSS 8.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/zkteco
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.