# ZKTeco CCTV Cameras Leak Admin Credentials via Undocumented Backdoor Port
## The Threat
A critical authentication bypass vulnerability in ZKTeco CCTV cameras exposes sensitive system information, including administrative credentials and active service configurations, to unauthenticated remote attackers. The flaw stems from an undocumented configuration export port that operates without any authentication requirements, effectively creating a direct pathway to camera credentials for anyone on the network.
ZKTeco is a major supplier of surveillance hardware to commercial facilities globally, making this vulnerability a significant concern for enterprises relying on these cameras for physical security. The exposed information goes beyond simple metadata—attackers could obtain the actual account credentials needed to access and manipulate camera settings, disable recording, or pivot further into networked systems.
The vulnerability affects ZKTeco SSC335-GC2063-Face models running firmware versions prior to V5.0.1.2.20260421. Given the deployment of these devices across critical infrastructure, commercial facilities, and various sectors worldwide, the remediation timeline is particularly urgent.
## Severity and Impact
| Metric | Value |
|--------|-------|
| CVE Identifier | CVE-2026-8598 |
| CVSS v3.1 Score | 9.1 (CRITICAL) |
| Base Severity | CRITICAL |
| Vector String | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Confidentiality Impact | High |
| Integrity Impact | High |
| Availability Impact | None |
| CWE | CWE-288 (Authentication Bypass Using an Alternate Path or Channel) |
The CVSS score of 9.1 reflects the ease of exploitation (no authentication, no user interaction required, simple network access) combined with severe confidentiality and integrity impacts. Attackers can retrieve administrative credentials with minimal technical effort, and those credentials could be leveraged to modify camera configurations or gain deeper access to connected networks.
## Affected Products
ZKTeco CCTV Cameras:
## Mitigations
Firmware Update (Primary):
ZKTeco has released a patch in firmware version V5.0.1.2.20260421 and later. Organizations should prioritize upgrading affected cameras to this version or newer immediately. Consult ZKTeco's official security advisory for detailed upgrade procedures specific to your deployment.
Network Segmentation (Interim):
Until firmware updates can be deployed:
Credential Rotation:
After patching, rotate all camera administrative credentials. Assume any credentials previously stored on the device may have been compromised prior to the update.
Monitoring and Detection:
Remote Access Controls:
If remote access to cameras is required, enforce the use of VPN connections with modern encryption and multi-factor authentication. Direct internet exposure of surveillance systems should be avoided.
## References
---
## HackWire Analysis
This vulnerability represents a textbook case of security through obscurity backfiring catastrophically. The existence of an undocumented configuration export port reveals a troubling development practice: ZKTeco apparently never intended this port to be exposed to hostile networks, yet it shipped in production firmware without authentication. This isn't a feature with a weak auth layer—it's infrastructure that was never designed with multi-tenant or adversarial access in mind.
What makes this particularly dangerous is the target: CCTV systems are infrastructure that many organizations assume is secure because it's "internal." But credential exposure on cameras creates a beachhead. Camera credentials often follow predictable patterns, share naming conventions with other systems, and sometimes leverage weak secrets like "admin/12345"—and now attackers don't even need to guess. With valid credentials exposed, an attacker gains legitimate access to modify video feeds, disable alerts, or use the camera's network position to scan for further vulnerabilities in connected infrastructure.
The "no known public exploitation" status in the advisory should not provide false comfort. Critical CCTV vulnerabilities with CVSS 9.1 ratings and published advisories typically see exploitation attempts within days or weeks of disclosure. This is not a slow-burn threat—organizations running unpatched SSC335-GC2063-Face cameras are operating on borrowed time.
The broader pattern here mirrors what we've seen repeatedly in IoT and industrial equipment: vendors shipping devices with hardcoded or trivial default security postures, banking on network isolation to provide actual security. When those devices end up connected (intentionally or through misconfiguration), the results are predictable. ZKTeco's worldwide deployment footprint means this vulnerability affects a large install base—government facilities, airports, retail chains, and enterprises across multiple critical sectors.
Defenders should treat this as a high-priority remediation task with a measured but swift timeline. Firmware updates should be staged through test environments first (to avoid breaking camera functionality), but delay beyond one to two weeks is not advisable for a CRITICAL remote vulnerability affecting physical security infrastructure.
— HackWire Editorial
## Related Coverage