CVE-2026-8598

CRITICAL

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

CVSS v3.1 Score

9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Published: 5/20/2026Modified: 5/20/2026

Related Intelligence (1)

CRITICALApt

ZKTeco CCTV Cameras

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could result in information disclosure, including capture of camera account credentials.</strong></p> <p>The following versions of ZKTeco CCTV Cameras are affected:</p> <ul> <li>SSC335-GC2

CVE-2026-8598
CISA Advisories

References (3)

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-04.jsonhttps://www.cisa.gov/news-events/ics-advisories/icsa-26-139-04https://www.zkteco.com/en/announcement/23