CVE-2022-42953
High
Description
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
SeverityHigh
CVSS7.5
Exploit probability—
ProductZkteco Zmm200 Firmware
PublishedDec 25, 2022
First seenDec 25, 2022
Weakness typeCWE-425CWE-425
How to fix
Update
- zkteco zmm200_firmware15.00 or later
- zkteco zmm210_firmware15.00 or later
- zkteco zmm220_firmware15.00 or later
- zkteco zem720_firmware8.88 or later
- zkteco zem600_firmware8.88 or later
- zkteco zem800_firmware8.88 or later
- zkteco zem510_firmware8.88 or later
- zkteco zem560_firmware8.88 or later
- zkteco zem760_firmware8.88 or later
- zkteco zem500_firmware8.88 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zkteco zmm200_firmware | v < 15.00 | 15.00 |
| zkteco zmm210_firmware | v < 15.00 | 15.00 |
| zkteco zmm220_firmware | v < 15.00 | 15.00 |
| zkteco zem720_firmware | v < 8.88 | 8.88 |
| zkteco zem600_firmware | v < 8.88 | 8.88 |
| zkteco zem800_firmware | v < 8.88 | 8.88 |
| zkteco zem510_firmware | v < 8.88 | 8.88 |
| zkteco zem560_firmware | v < 8.88 | 8.88 |
| zkteco zem760_firmware | v < 8.88 | 8.88 |
| zkteco zem500_firmware | v < 8.88 | 8.88 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.