QSearchQSearch

CVE-2025-15128

5.3 MEDIUM

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2

Published: 2025-12-28 · Last updated: 2026-06-11

Severity and scoring

CVSS
5.3 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
CWE-255, CWE-256

Description

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 9.0.6 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor confirms: "The mainstream version ZKBioTime V9.0.6 has fixed this vulnerability. Please update to the latest version as soon as possible. For the Middle East version BioTime 9.5.X, you can contact the local technical support to obtain the fix package."

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2024-45636 — IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user (4.1 MEDIUM)
  • CVE-2026-11552 — A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management ... (5.3 MEDIUM)
  • CVE-2026-11515 — A vulnerability has been found in SourceCodester Barangay Resident Profiling and Information Management System 1.0 (5.3 MEDIUM)
  • CVE-2026-36174 — GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console (4.6 MEDIUM)
  • CVE-2018-25396 — Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administra... (7.5 HIGH)