Lucene search

CVE-2022-42953

🗓️ 25 Dec 2022 05:10:15Reported by mitreType

cve🔗 web.nvd.nist.gov👁 160 Views🌐 WEB

ZKTeco products allow access to sensitive information via direct requests

Reporter	Title	Published	Views	Family All 7
Prion	Information disclosure	25 Dec 202205:15	–	prion
Packet Storm	ZKTeco ZEM500-510-560-760 / ZEM600-800 / ZEM720 / ZMM Missing Authentication	25 Oct 202200:00	–	packetstorm
0day.today	ZKTeco ZEM/ZMM 8.88 - Missing Authentication Vulnerability	28 Mar 202300:00	–	zdt
0day.today	ZKTeco ZEM500-510-560-760 / ZEM600-800 / ZEM720 / ZMM Missing Authentication Vulnerability	25 Oct 202200:00	–	zdt
NVD	CVE-2022-42953	25 Dec 202205:15	–	nvd
Cvelist	CVE-2022-42953	25 Dec 202200:00	–	cvelist
Exploit DB	ZKTeco ZEM/ZMM 8.88 - Missing Authentication	28 Mar 202300:00	–	exploitdb

Nvd

Node

zkteco zmm200_firmwareRange<15.00

AND

zkteco zmm200Match-

Node

zkteco zmm210_firmwareRange<15.00

AND

zkteco zmm210Match-

Node

zkteco zmm220_firmwareRange<15.00

AND

zkteco zmm220Match-

Node

zkteco zem720_firmwareRange<8.88

AND

zkteco zem720Match-

Node

zkteco zem600_firmwareRange<8.88

AND

zkteco zem600Match-

Node

zkteco zem800_firmwareRange<8.88

AND

zkteco zem800Match-

Node

zkteco zem510_firmwareRange<8.88

AND

zkteco zem510Match-

Node

zkteco zem560_firmwareRange<8.88

AND

zkteco zem560Match-

Node

zkteco zem760_firmwareRange<8.88

AND

zkteco zem760Match-

Node

zkteco zem500_firmwareRange<8.88

AND

zkteco zem500Match-

Source	Link
seclists	www.seclists.org/fulldisclosure/2022/Oct/23
redteam-pentesting	www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses

Parameter	Position	Path	Description	CWE
style	query param	/form/DataApp	Access to sensitive information without authentication through style parameter.	CWE-425
did	query param	/csl/user	Direct access to user details without authentication.	CWE-425
uid	query param	/csl/user	Direct access to user details without authentication.	CWE-425

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

25 Dec 2022 05:15Current

7.3High risk

Vulners AI Score7.3

CVSS37.5

EPSS0.11404

CWE-425