CVE-2025-55279
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-08-13

Last updated on: 2025-08-13

Assigner: Indian Computer Emergency Response Team (CERT-In)

Description
This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve private key stored in the firmware of the targeted device. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-08-13
Last Modified
2025-08-13
Generated
2026-05-06
AI Q&A
2025-08-13
EPSS Evaluated
2026-05-05
NVD
CVE-2025-55279
EUVD
EUVD-2025-24556
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
zkteco wl20 *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-798 The product contains hard-coded credentials, such as a password or cryptographic key.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in ZKTeco WL20 devices because a hard-coded private key is stored in plaintext within the device firmware. An attacker with physical access to the device can extract the firmware and analyze its binary data to retrieve this private key.


How can this vulnerability impact me? :

If exploited, an attacker could use the retrieved private key to decrypt sensitive data without authorization and perform Man-in-the-Middle (MitM) attacks on the targeted device, potentially compromising the confidentiality and integrity of communications and data.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart