CVE-2020-17474: ZKTeco Facedepot 7b Firmware

Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days.

A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate users to administrators, delete users, and download user faces from the database.

Affected products

• ZKTeco Facedepot 7b Firmware: version 1.0.213 only
• ZKTeco Zkbiosecurity Server: version 1.0.0_20190723 only

Published 2020-08-14. Last modified 2026-06-17.