7.5

CVE-2022-42953

Exploit
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zkteco ≫ Zmm200 Firmware Version < 15.00
   Zkteco ≫ Zmm200 Version -
Zkteco ≫ Zmm210 Firmware Version < 15.00
   Zkteco ≫ Zmm210 Version -
Zkteco ≫ Zmm220 Firmware Version < 15.00
   Zkteco ≫ Zmm220 Version -
Zkteco ≫ Zem720 Firmware Version < 8.88
   Zkteco ≫ Zem720 Version -
Zkteco ≫ Zem600 Firmware Version < 8.88
   Zkteco ≫ Zem600 Version -
Zkteco ≫ Zem800 Firmware Version < 8.88
   Zkteco ≫ Zem800 Version -
Zkteco ≫ Zem510 Firmware Version < 8.88
   Zkteco ≫ Zem510 Version -
Zkteco ≫ Zem560 Firmware Version < 8.88
   Zkteco ≫ Zem560 Version -
Zkteco ≫ Zem760 Firmware Version < 8.88
   Zkteco ≫ Zem760 Version -
Zkteco ≫ Zem500 Firmware Version < 8.88
   Zkteco ≫ Zem500 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.83% 0.909
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-425 Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
Third Party Advisory
Exploit
https://seclists.org/fulldisclosure/2022/Oct/23
Third Party Advisory
Exploit
Mailing List