The vulnerability in ZKTeco ZKBioSecurity 3.0 lies in the visLogin.jsp page, which allows an attacker to bypass local authorization by forging a request that appears to originate from the localhost. The application’s EnvironmentUtil.getClientIp() method incorrectly treats the IPv6 loopback address 0:0:0:0:0:0:0:1 as the IPv4 address 127.0.0.1. When this spoofed IP is submitted, the system accepts it as a username and permits login with the hardcoded password 123456, thereby granting access to sensitive information and enabling the execution of unauthorized actions.

Affected are installations of ZKTeco Inc.’s ZKBioSecurity product, specifically version 3.0. No other versions are listed, so the risk applies to that release only.

The vulnerability carries a CVSS score of 6.8 and an EPSS probability of less than 1%, indicating moderate severity and low overall exploitation likelihood. It is not catalogued as a known exploited vulnerability. The attack vector requires an entity able to craft a request that mimics a localhost connection, which could be possible from an internal network or a machine with network access to the device. If the device is exposed to external networks, the risk could increase but the requirement for loopback spoofing still limits widespread exploitation.