ZKTeco WL20 Information Disclosure Vulnerability

A vulnerability allowing information disclosure exists in the ZKTeco WL20 Biometric Attendance System, all versions through ZLM31-FXO1-3.1.8. This vulnerability arises from the storage of Wi-Fi credentials, configuration data, and system data in plaintext within the device firmware. An attacker with physical access could exploit this issue by extracting the firmware and reverse engineering the binary data to access the unencrypted sensitive information. Successful exploitation could lead to unauthorized network access and the ability to retrieve and manipulate data on the affected device.

Impact

Exploitation of this vulnerability could result in unauthorized access to network resources and the ability to retrieve and modify data on the affected device.

Remediation

Users are advised to upgrade the ZKTeco WL20 Biometric Attendance System firmware to version ZLM31-FXO1-4.0.3. If no vendor instructions are available, consider discontinuing use of the product. Additionally, implement physical security measures to prevent unauthorized access to the device.