5.5

CVE-2025-15128

Exploit

ZKTeco BioTime Endpoint safe_setting credentials storage

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 9.0.6 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor confirms: "The mainstream version ZKBioTime V9.0.6 has fixed this vulnerability. Please update to the latest version as soon as possible. For the Middle East version BioTime 9.5.X, you can contact the local technical support to obtain the fix package."
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerZKTeco
≫
Produkt BioTime
Version 9.0.0
Status affected
Version 9.0.1
Status affected
Version 9.0.2
Status affected
Version 9.0.3
Status affected
Version 9.0.4
Status affected
Version 9.5.0
Status affected
Version 9.5.1
Status affected
Version 9.5.2
Status affected
Version 9.0.6
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.187
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cna@vuldb.com 5.5 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
cna@vuldb.com 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cna@vuldb.com 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-256 Plaintext Storage of a Password

Storing a password in plaintext may result in a system compromise.

https://github.com/ionutluca888/IDOR-POC-ZKBio-Time/tree/main
https://vuldb.com/cve/CVE-2025-15128
https://vuldb.com/submit/711813
https://vuldb.com/vuln/338506
https://vuldb.com/vuln/338506/cti
https://www.zkteco.com/en/Security_Bulletinsibs/24