CVE-2026-8598
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.
Risk Assessment
An attacker can remotely obtain sensitive credentials and configuration details, enabling full control over the camera and potential access to the entire surveillance network.
Recommendation
Immediately block access to the undocumented port via network firewall and contact the vendor for a security patch.
Original NVD description (English source)
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.