Is CVE-2022-42953 actively exploited?

CVE-2022-42953 has no public evidence of in-the-wild exploitation as of 2025-04-15.

What is the CVSS score for CVE-2022-42953?

CVE-2022-42953 has a CVSS score of 7.5 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

How do I patch CVE-2022-42953?

Patch guidance is available from zkteco security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2022-42953.

Fix CVE-2022-42953 - HIGH zkteco zmm200 firmware

Q: Which products are affected by CVE-2022-42953?

10 products: zkteco zmm200 firmware, zkteco zmm210 firmware, zkteco zmm220 firmware, zkteco zem720 firmware, zkteco zem600 firmware, and 5 more.

Description

Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
Weaknesses: CWE-425 CWE-425

Metadata

Primary Vendor: ZKTECO
Published: 12/25/2022
Last Modified: 4/15/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

zkteco : zmm200_firmwarezkteco : zmm210_firmwarezkteco : zmm220_firmwarezkteco : zem720_firmwarezkteco : zem600_firmwarezkteco : zem800_firmwarezkteco : zem510_firmwarezkteco : zem560_firmwarezkteco : zem760_firmwarezkteco : zem500_firmware

Remediation Guidance

Executive Summary

View on NIST NVD