The vulnerability in the ZKTeco ZKBioSecurity 3.0 appliance arises from hard‑coded credentials embedded in the bundled Apache Tomcat server. These credentials grant unrestricted access to the Tomcat manager application, enabling an unauthenticated attacker to upload malicious WAR files containing JSP code. Once uploaded, the attacker can execute arbitrary code with SYSTEM privileges on the underlying operating system. This type of flaw, classified as CWE‑798, results in full compromise of confidentiality, integrity, and availability for systems running the affected firmware.

Affected products include the ZKTeco ZKBioSecurity 3.0 biometric security appliance. No further version details are supplied by the CNA, so administrators should verify whether their deployed units match the 3.0 release or a later iteration that may contain the issue.

With a CVSS score of 9.3, the vulnerability presents a critical risk. The EPSS score is reported as below 1%, indicating a relatively low probability of exploitation in the wild, and the issue does not appear in the CISA KEV catalog. Based on the description, it is inferred that attackers can exploit this flaw remotely by connecting to the Tomcat manager interface from any network that can reach the appliance, using the hard‑coded credentials to gain access and upload malicious code.