CVE-2026-8598: Unauthenticated Export Service in ZKTeco CCTV Cameras
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZKTeco CCTV camera firmwareto a version that resolves this vulnerability.Fixed in V5.0.1.2.20260421 - Compensating control
If immediate firmware upgrade is not possible, restrict network access to the undocumented export service/port so it is not reachable without authorization (since the export port is described as accessible and does not require authentication).
- Operational
After upgrading, review/rotate ZKTeco camera account credentials (account credentials are mentioned as potentially exposed by the unauthenticated export service).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8598?
CVE-2026-8598 is considered a critical vulnerability due to unauthorized access to sensitive camera configuration information.
How do I fix CVE-2026-8598?
To mitigate CVE-2026-8598, disable the undocumented export service and ensure all firmware is updated to the latest version provided by ZKTeco.
What types of ZKTeco cameras are affected by CVE-2026-8598?
CVE-2026-8598 affects various models of ZKTeco CCTV cameras that expose an unauthenticated export service.
What information can be accessed due to CVE-2026-8598?
CVE-2026-8598 allows access to critical information, including open services and camera account credentials.
Is authentication required for accessing the export service in CVE-2026-8598?
No, the export service affected by CVE-2026-8598 does not require any authentication for access.