CVE-2025-45746CRITICAL 9.8EPSS p21.4%

CVE-2025-45746CVE-2025-45746

Description

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.30% probability of exploitation · percentile 21.4% · 2026-06-18T12:00:27Z
Published2025-05-13
Last modified2025-05-21

Underlying weaknesses· 2

CWE-321CWE-798

References

  1. https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2025-45746.md

2

TypeTargetConfidenceTier
WeaknessUse of Hard-coded Cryptographic Keycwe-3210%live
WeaknessUse of Hard-coded Credentialscwe-7980%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-41672
CVE
CVE-2025-35940
CVE
CVE-2025-41702
CVE
CVE-2016-20026
CVE
CVE-2025-51606
CVE
CVE-2025-64075
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.