CVE-2025-55279— Hard-coded Private Key Vulnerability in ZKTeco WL20
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-55279
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hard-coded Private Key Vulnerability in ZKTeco WL20
Source: NVD (National Vulnerability Database)
Vulnerability Description
This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve private key stored in the firmware of the targeted device. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的凭证
Source: NVD (National Vulnerability Database)
Vulnerability Title
ZKTeco WL20 信任管理问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZKTeco WL20是中国熵基科技（ZKTeco）公司的一款智能指纹考勤机。 ZKTeco WL20存在信任管理问题漏洞，该漏洞源于设备固件中存储了硬编码的私钥，可能导致物理访问攻击者提取私钥并执行未经授权的解密和中间人攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ZKTeco Co | WL20 Biometric Attendance System | <=ZLM31-FXO1-3.1.8 | - |
II. Public POCs for CVE-2025-55279
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-55279
请登录查看更多情报信息。
Same Patch Batch · ZKTeco Co · 2025-08-13 · 4 CVEs total
| CVE-2025-54464 | Cleartext Storage Vulnerability in ZKTeco WL20 | |
| CVE-2025-54465 | Hard-coded Credentials Vulnerability in ZKTeco WL20 | |
| CVE-2025-55280 | Information Disclosure Vulnerability in ZKTeco WL20 |
IV. Related Vulnerabilities
Same weakness: CWE-798
- CVE-2026-7414
Hardcoded credentials in Yarbo robot firmware - CVE-2026-8032
PicoTronica e-Clinic Healthcare System ECHS echs.js hard-cod - CVE-2026-32834
Easy PayPal Events & Tickets 1.3 Authentication Bypass via Q - CVE-2026-42376
D-Link DIR-456U A1 Hardcoded Telnet Backdoor Credentials - CVE-2026-42375
D-Link DIR-600L A1 Hardcoded Telnet Backdoor Credentials
V. Comments for CVE-2025-55279
No comments yet