CVE-2022-42953

Vulnerability

Certain ZKTeco biometric devices, including ZEM500-510-560-760, ZEM600-800, ZEM720, and ZMM series models, are vulnerable to information disclosure through direct HTTP requests to the /form/DataApp?style=1 and /form/DataApp?style=0 URLs. This vulnerability affects firmware versions before 8.88 (for the ZEM range) and before 15.00 (for the ZMM range). The flaw resides in the device's web interface, which exposes sensitive configuration data without requiring authentication. [1]

Exploitation

An attacker can exploit this vulnerability by sending crafted HTTP GET requests to the targeted device's web server at the paths form/DataApp?style=1 or form/DataApp?style=0. The attacker does not need any prior authentication, user interaction, or special network position beyond network access to the device. No race condition or privileged access is required. The attack is simple and can be performed with standard HTTP tools. [1]

Impact

Successful exploitation allows an attacker to retrieve sensitive information from the device, including device configuration, network settings, and potentially user credentials or other private data. This information disclosure can aid in further attacks against the device or the network it resides on. The impact is limited to information disclosure, but the exposed data can be highly sensitive. [1]

Mitigation

ZKTeco has released firmware version 8.88 for the ZEM500-510-560-760, ZEM600-800, and ZEM720 models, and firmware version 15.00 for the ZMM200-220-210 models, which fix this vulnerability. Users are advised to update their devices to the latest firmware versions. If updating is not immediately possible, restricting network access to the device's web interface via firewall rules or network segmentation can reduce exposure. The CVE is not known to be listed in CISA's Known Exploited Vulnerabilities (KEV) catalog at the time of publication. [1]