ZKTeco Biometric System Found Vulnerable to 24 Critical Security Flaws

Kaspersky researchers reported 24 vulnerabilities in a ZKTeco biometric access system (firmware ZAM170-NF-1.8.25-7354-Ver1.0.0), including multiple high-severity issues (command injection, arbitrary file write/read, SQL injection, and stack-based buffer overflows) that could allow attackers to bypass authentication, steal biometric data, execute code as root, and deploy backdoors; recommended mitigations include network segmentation for biometric readers, strong admin passwords, minimizing QR code use, and keeping devices updated.