ZKTeco CCTV cameras leak credentials via unauthenticated export
ZKTeco CCTV cameras contain an unauthenticated configuration export port exposing camera credentials and service information; patch available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed CVE-2026-8598, an authentication bypass vulnerability affecting ZKTeco CCTV cameras model SSC335-GC2063-Face-0b77 running firmware versions prior to V5.0.1.2.20260421. The vulnerability stems from an undocumented configuration export port that requires no authentication, allowing remote attackers to access critical camera information including account credentials and details about open services. This represents a significant security risk for organizations deploying these cameras in commercial facilities.
ZKTeco has released firmware version V5.0.1.2.20260421 to address this vulnerability and recommends immediate deployment. The vendor has published a security advisory with additional remediation guidance. While no active exploitation has been reported to CISA at the time of this advisory, the ease of exploitation and sensitive nature of exposed credentials warrant urgent patching. Organizations should prioritize upgrading affected devices and implementing network segmentation to limit exposure of ICS/IoT devices to untrusted networks.
The vulnerability was responsibly disclosed by security researcher Souvik Kandar. CISA emphasizes standard ICS security best practices including network isolation, firewall deployment, and use of VPNs for remote access as complementary defensive measures beyond patching.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-04
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs