CVE-2025-54464highCWE-312

CVE-2025-54464: high-severity vulnerability in ZKTeco Co WL20 Biometric Attendance System

Cleartext Storage Vulnerability in ZKTeco WL20

Published

Follow this CVE+ Monitor WL20 Biometric Attendance System

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7epss 0.1%
This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
ZKTeco Co · WL20 Biometric Attendance System
Related CVEs — ZKTeco Co WL20 Biometric Attendance System

In the same product, most dangerous first.

CVE-2025-54465MEDIUMHard-coded Credentials Vulnerability in ZKTeco WL20EPSS 0.2%CVE-2025-55279MEDIUMHard-coded Private Key Vulnerability in ZKTeco WL20EPSS 0.2%CVE-2025-55280MEDIUMInformation Disclosure Vulnerability in ZKTeco WL20EPSS 0.1%