CVE-2025-45746 - CVE House
Back to Database
Status published Medium CVE-2025-45746

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft...

Vulnerability Description

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-45746

Credits & Attribution

No credits recorded in the NVD database.

References

More from ZKTeco

View All →
CVE-2025-15128
ZKTeco BioTime Endpoint safe_setting credentials storage
Medium 6.9
CVE-2024-6523
ZKTeco BioTime system-group-add cross site scripting
Medium 5.3
CVE-2024-6344
ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
Medium 4.8
CVE-2024-6006
ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting
Medium 5.1
CVE-2024-6005
ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting
Medium 5.1

Affected Vendor

Affected Software

ZKBio CVSecurity
Vulnerable Versions:
6.4.1_R

Timeline

Official Publish: May 13th, 2025
Last Modified: May 21st, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-321

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1040 Network Sniffing
Credential Access
T1537 Transfer Data to Cloud Account
Credential Access
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration