This vulnerability is a cross‑site request forgery that allows an attacker to create superadmin accounts on ZKTeco ZKBioSecurity 3.0 by exploiting missing authenticity checks. An authenticated user who visits a malicious page can trigger the creation of a new superadmin account without any validation, giving the attacker full administrative control over the system. The weakness is a classic CSRF (CWE‑352).

The affected product is ZKTeco Inc.’s ZKBioSecurity 3.0. No additional product versions are listed, so any instance running this version is at risk.

The vulnerability scores a moderate CVSS of 5.3 and an EPSS of less than 1 %, indicating that overall exploitation is unlikely under normal circumstances. The attack vector is client‑side – an attacker must persuade an already‑authenticated user to visit a malicious site that sends crafted HTTP requests. It is not listed in the CISA KEV catalog, but the potential to add superadmin accounts poses a serious risk if exploited.