CVE-2026-8598

critical · 9.1

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

9.1

CVSS

0.5%

EPSS (exploit prob.)

42nd

EPSS percentile

2026-05-20

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-288

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-04.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-04
https://www.zkteco.com/en/announcement/23

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-8598