CVE-2025-15128

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15128
A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 9.0.6 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor confirms: "The mainstream version ZKBioTime V9.0.6 has fixed this vulnerability. Please update to the latest version as soon as possible. For the Middle East version BioTime 9.5.X, you can contact the local technical support to obtain the fix package."

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/ionutluca888/IDOR-POC-ZKBio-Time/tree/main
https://vuldb.com/cve/CVE-2025-15128
https://vuldb.com/submit/711813
https://vuldb.com/vuln/338506
https://vuldb.com/vuln/338506/cti
https://www.zkteco.com/en/Security_Bulletinsibs/24
Configurations

No configuration.

History

11 Jun 2026, 09:16

Type Values Removed Values Added
References
  • {'url': 'https://vuldb.com/?ctiid.338506', 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?id.338506', 'source': 'cna@vuldb.com'}
  • {'url': 'https://vuldb.com/?submit.711813', 'source': 'cna@vuldb.com'}
  • () https://vuldb.com/cve/CVE-2025-15128 -
  • () https://vuldb.com/submit/711813 -
  • () https://vuldb.com/vuln/338506 -
  • () https://vuldb.com/vuln/338506/cti -
  • () https://www.zkteco.com/en/Security_Bulletinsibs/24 -
Summary (en) A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 9.0.6 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor confirms: "The mainstream version ZKBioTime V9.0.6 has fixed this vulnerability. Please update to the latest version as soon as possible. For the Middle East version BioTime 9.5.X, you can contact the local technical support to obtain the fix package."

24 Feb 2026, 07:16

Type Values Removed Values Added
Summary (en) A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

28 Dec 2025, 09:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-28 09:15

Updated : 2026-06-17 08:37

NVD link : CVE-2025-15128

Mitre link : CVE-2025-15128

CVE.ORG link : CVE-2025-15128

JSON object : View

Products Affected

No product.

CWE
CWE-255

Credentials Management Errors

CWE-256

Plaintext Storage of a Password