Security Vulnerability in ZKTeco WL20 IoT Device
CVE-2025-54465

6.8MEDIUM

Key Information:

Vendor

Zkteco Co

Status
Wl20 Biometric Attendance System
Vendor
CVE Published:
13 August 2025

What is CVE-2025-54465?

The ZKTeco WL20 device contains a vulnerability stemming from hard-coded MQTT credentials and endpoints that are stored in plaintext within its firmware. An attacker with physical access could exploit this weakness by extracting the device's firmware and analyzing the binary data to uncover the hard-coded MQTT credentials. This unauthorized access could allow the attacker to manipulate the communications of the IoT device, leading to potential breaches in data integrity and confidentiality.

Affected Version(s)

WL20 Biometric Attendance System <=ZLM31-FXO1-3.1.8

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOT...
third-party-advisory
https://www.zkteco.com/en/Security_Bulletinsibs/20
vendor-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability is reported by Shravan Singh from Kavach IoT Security.
.
CVE-2025-54465 : Security Vulnerability in ZKTeco WL20 IoT Device