CVE-2022-42953 Missing authorization in n/a
Attackers can access sensitive information via direct URL requests on ZKTeco devices, requiring firmware upgrades to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-42953?
CVE-2022-42953 is a high-severity missing authorization vulnerability in n/a, published on 25 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).
Weakness: CWE-425
Which versions are affected by CVE-2022-42953?
It affects 10 products.
Products include Zkteco Zem500 Firmware, Zkteco Zem510 Firmware, Zkteco Zem560 Firmware, Zkteco Zem600 Firmware, Zkteco Zem720 Firmware, Zkteco Zem760 Firmware and 4 more.
How do I fix CVE-2022-42953?
No fix has been published for CVE-2022-42953 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-42953 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-42953 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as GHSA-54r9-6x6g-2vfv.