CVE-2025-54464
HIGHZKTeco WL20 Biometric Attendance System <= ZLM31-FXO1-3.1.8 - Cleartext Storage of Sensitive Information in Firmware
Title source: llmDescription
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.
References (2)
Core 2
Core References
Various Sources third-party-advisory
https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172
Various Sources vendor-advisory
https://www.zkteco.com/en/Security_Bulletinsibs/20
Scores
CVSS v4
7.0
EPSS
0.0008
EPSS Percentile
0.3%
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-312
Status
published
Products (1)
ZKTeco Co/WL20 Biometric Attendance System
<=ZLM31-FXO1-3.1.8
Published
Aug 13, 2025
Tracked Since
Feb 18, 2026