CVE-2025-45746: Critical severity zkteco zkbio cvsecurity vulnerability
In ZKT ZKBio CVSecurity 6.4.1R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-45746?
CVE-2025-45746 has been classified as critical due to the potential for unauthenticated access to the service console.
How do I fix CVE-2025-45746?
To mitigate CVE-2025-45746, update ZKT ZKBio CVSecurity to the latest version where the hardcoded secret vulnerability is addressed.
Who is affected by CVE-2025-45746?
CVE-2025-45746 affects all instances of ZKT ZKBio CVSecurity version 6.4.1_R.
What type of attack is possible with CVE-2025-45746?
An unauthenticated attacker can craft a JWT token to gain unauthorized access to the service console due to this vulnerability.
Is there a known exploit for CVE-2025-45746?
Yes, there are known methods to exploit CVE-2025-45746 by using the hardcoded secret to create valid JWT tokens.