CVE-2022-42953 EXPLOIT
7.5
HIGH · CVSS 3.1 · EPSS 5% (pctl 92)
Patch early
A public exploit exists.
Description
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
Scoring
| CVSS | 7.5 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 4.97% — more likely to be exploited than 92% of all CVEs |
| Weakness | CWE-425 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2022-12-25 |
| Last modified | 2026-06-17 |
Affected (20)
| Vendor | Product |
|---|---|
| zkteco | zem500 |
| zkteco | zem500 firmware |
| zkteco | zem510 |
| zkteco | zem510 firmware |
| zkteco | zem560 |
| zkteco | zem560 firmware |
| zkteco | zem600 |
| zkteco | zem600 firmware |
| zkteco | zem720 |
| zkteco | zem720 firmware |
| zkteco | zem760 |
| zkteco | zem760 firmware |
| zkteco | zem800 |
| zkteco | zem800 firmware |
| zkteco | zmm200 |
| zkteco | zmm200 firmware |
| zkteco | zmm210 |
| zkteco | zmm210 firmware |
| zkteco | zmm220 |
| zkteco | zmm220 firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | ZKTeco ZEM/ZMM 8.88 - Missing Authentication | 2023-03-28 |
References
→ the Explorer · watch your stack · NVD