CVE-2025-55280

Summary

This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the plaintext sensitive data stored in the targeted device.

Successful exploitation of this vulnerability could allow the attacker to gain unauthorized network access, retrieve and manipulate data on the targeted device.

Affected Software

VendorProductVersion RangeStatus
ZKTeco CoWL20 Biometric Attendance System<=ZLM31-FXO1-3.1.8affected

Weaknesses

  • CWE-312: CWE-312: Cleartext Storage of Sensitive Information

Workarounds

  • Apply mitigations as per vendor instructions (whenever available) or discontinue the use of the product if mitigations are unavailable.
  • Perform risk assessment and implement physical security controls to prevent unauthorized access to the device.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References