CVE-2025-45746 is a medium severity flaw (CVSS 6.5) in ZKTeco ZKBio CVSecurity 6.4.1_R. The record says an unauthenticated attacker can forge a JWT using a hard-coded secret and reach the service console. The supplier disputes the significance. Keep the console off untrusted networks and check with the supplier.
What's affected
The record names ZKTeco ZKBio CVSecurity version 6.4.1_R. It does not list other versions and it names no fixed release.
The record carries a dispute note from the supplier. The supplier argues that the service console is normally reachable only from a local network, and that access to it does not give login or data access in the application platform. Both views can be true: the flaw exists, and its impact depends on where the console is exposed.
How to check if you're exposed
Start with where the console runs and who can reach it.
- Confirm whether you run ZKBio CVSecurity and read the version from the product's about or system page. The record names 6.4.1_R.
- Find out which port serves the service console and whether it is reachable beyond the management VLAN.
- Check firewall rules and any reverse proxy or port forwarding that publishes the console.
- Review access logs for console requests from addresses that are not administrators.
If the console is reachable only from a small, trusted network, your exposure is lower than the score suggests.
What to do now
- Confirm whether any ZKBio CVSecurity 6.4.1_R installation exists in your estate.
- Make sure the service console is not reachable from the internet or from general user networks.
- Restrict console access to named administrator hosts through firewall rules or a VPN.
- Ask ZKTeco whether a release changes the signing secret or removes the hard-coded value, and whether it is available for your licence.
- Review the console and platform for unexpected accounts or changed settings.
- Record the supplier's dispute position in your risk register so the decision is documented.
Why it matters
The record lists CWE-321 (Use of Hard-coded Cryptographic Key), CWE-798 (Use of Hard-coded Credentials). A JSON Web Token is only trustworthy if the secret used to sign it is private. When the same secret ships inside every copy of the software, anyone who learns it can sign tokens that the service accepts.
The rating is medium because the vector shows limited impact on confidentiality and integrity and no impact on availability. The supplier's dispute is a reminder to read the context: the same weakness is far more serious on an internet facing console than on one behind a management firewall. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Why is this rated only medium?
The CVSS vector shows limited confidentiality and integrity impact. The supplier also says console access does not give access to the application's data.
Is there a fix?
The record names none. Ask the supplier, and limit who can reach the console in the meantime.
Sources
Last reviewed: 18 October 2026.
