CVE-2022-42953: ZKTeco ZEM500 Firmware

High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days.

Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).

Affected products

• ZKTeco ZEM500 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM510 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM560 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM600 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM720 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM760 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZEM800 Firmware: before 8.88 (fixed in 8.88)
• ZKTeco ZMM200 Firmware: before 15.00 (fixed in 15.00)
• ZKTeco ZMM210 Firmware: before 15.00 (fixed in 15.00)
• ZKTeco ZMM220 Firmware: before 15.00 (fixed in 15.00)

Published 2022-12-25. Last modified 2026-06-17.