Cleartext Storage Vulnerability in ZKTeco WL20_CVE-2025-54464

7 / 10

HIGH

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.

Basic Information

ID CVE-2025-54464

Source CERT-In

Published Aug 13, 2025 at 11:12

Affected Product

Vendor ZKTeco Co

Product WL20 Biometric Attendance System

Version <=ZLM31-FXO1-3.1.8

Affected Versions ZKTeco Co WL20 Biometric Attendance System <=ZLM31-FXO1-3.1.8

CWE Classification

CWE-312

References

{
    "lastseen": "",
    "description": "This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.",
    "published": "2025-08-13T11:12:16.853Z",
    "modified": "2025-08-13T11:12:16.853Z",
    "type": "cve",
    "title": "Cleartext Storage Vulnerability in ZKTeco WL20",
    "source": "CERT-In",
    "references": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172\nhttps://www.zkteco.com/en/Security_Bulletinsibs/20",
    "id": "CVE-2025-54464",
    "bulletinFamily": "",
    "cwe": [
        "CWE-312"
    ],
    "cvelist": null,
    "sourceData": "ZKTeco Co WL20 Biometric Attendance System <=ZLM31-FXO1-3.1.8",
    "sourceHref": "",
    "cvss": {
        "score": 7,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "WL20 Biometric Attendance System",
    "version": "<=ZLM31-FXO1-3.1.8",
    "vendor": "ZKTeco Co",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}