CVE-2024-13966 ZKTeco BioTime default password

What is CVE-2024-13966?

CVE-2024-13966 is a medium-severity vulnerability in ZKTeco BioTime, published on 27 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").

Weakness: CWE-1393

Which versions are affected by CVE-2024-13966?

It affects 1 product.

Products include Zkteco Biotime.

How do I fix CVE-2024-13966?

No fix has been published for CVE-2024-13966 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-13966 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-13966 exists.

Other vulnerabilities in ZKTeco BioTime

• CVE-2023-38950 ZKTeco BioTime Path Traversal Exploited High 7.5
• CVE-2023-38951 Path traversal in n/a Critical 9.8
• CVE-2023-51142 Information disclosure in n/a High 7.5
• CVE-2023-38949 Auth bypass in n/a High 7.5
• CVE-2023-38952 Missing authorization in n/a High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fqmr-rqgw-fg3q.