CVE-2026-8598CWE-288
Unauthenticated Export Service in ZKTeco CCTV Cameras
Critical · published May 20, 2026
What it is
An undocumented configuration export port is accessible on some models
of ZKTeco CCTV cameras. This port does not require authentication and
exposes critical information about the camera such as open services and
camera account credentials.
The record
Technical detail
- CVSS v4.0
- 9.1 · CRITICAL
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS
- 0.00589 · 47.5th percentile
- Weakness
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel
- Published
- 2026-05-20T14:53Z
EPSS history
Timeline