What’s Vulnerable › Vulnerabilities
CVE-2022-42953
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 5.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2022-12-25 · updated 2026-06-17
- Weakness: CWE-425
Description
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
Affected products
- ZKTeco Zem500 Firmware: before 8.88 — fixed in 8.88
- ZKTeco Zem510 Firmware: before 8.88 — fixed in 8.88
- ZKTeco Zem560 Firmware: before 8.88 — fixed in 8.88
- ZKTeco Zem600 Firmware: before 8.88 — fixed in 8.88
- ZKTeco Zem720 Firmware: before 8.88 — fixed in 8.88
- ZKTeco Zem760 Firmware: before 8.88 — fixed in 8.88
- ZKTeco ZEM800: before 8.88 — fixed in 8.88
- ZKTeco Zmm200 Firmware: before 15.00 — fixed in 15.00
- ZKTeco Zmm210 Firmware: before 15.00 — fixed in 15.00
- ZKTeco Zmm220 Firmware: before 15.00 — fixed in 15.00
How to fix
Upgrade to a fixed version: ZKTeco Zem500 Firmware 8.88; ZKTeco Zem510 Firmware 8.88; ZKTeco Zem560 Firmware 8.88; ZKTeco Zem600 Firmware 8.88; ZKTeco Zem720 Firmware 8.88; ZKTeco Zem760 Firmware 8.88; ZKTeco ZEM800 8.88; ZKTeco Zmm200 Firmware 15.00; ZKTeco Zmm210 Firmware 15.00; ZKTeco Zmm220 Firmware 15.00. Check the vendor advisory for mitigations.
References
- https://seclists.org/fulldisclosure/2022/Oct/23
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
- https://seclists.org/fulldisclosure/2022/Oct/23
- https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
Get alerted when CVE-2022-42953 or the next vulnerability affects your stack