Description
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.
Scores
CVSS v4
7.0
EPSS
0.0001
EPSS Percentile
2.2%
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-312
Status
published
Products (1)
ZKTeco Co/WL20 Biometric Attendance System
<=ZLM31-FXO1-3.1.8
Published
Aug 13, 2025
Tracked Since
Feb 18, 2026