by Kastro
Paper/Archive/CVE-2026-8598

CVE-2026-8598

ZKTeco SSC335-GC2063-Face-0b77 Solution Camera — Unauthenticated Export Service in ZKTeco CCTV Cameras

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 43.3.433 × 208.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

Affected

ProductAffectedFixed inSource
SSC335-GC2063-Face-0b77 Solution Camera< V5.0.1.2.20260421V5.0.1.2.20260421CNA

Scores by source

icscert (CNA)9.1CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryzkteco.com/en/announcement/23refcisa.gov/news-events/ics-advisories/icsa-26-139-04refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-04.json