ZKTeco BioTime Default Password Vulnerability

A vulnerability in ZKTeco BioTime allows unauthenticated attackers to log in as any user whose password has not been changed from the default '123456'. This issue arises because usernames can be easily enumerated, and the application does not properly validate user roles, enabling employees to perform administrative actions. Users are advised to change their passwords through the 'Self-Password' option in the Attendance Settings.

Impact

Exploitation of this vulnerability allows unauthorized access to user accounts, with the potential for privilege escalation to administrative rights, depending on the account accessed.

Reproduction

The vulnerability can be reproduced by enumerating usernames and attempting to log in with the default password '123456'. Once logged in, if the account has administrative privileges, it is possible to perform admin actions.

Remediation

Users should change their passwords in the Attendance Settings under 'Self-Password'.