ZKTeco CCTV Cameras EUVD-2026-31124

Exploitation requires network-layer reachability to the undocumented configuration-export TCP port on a ZKTeco SSC335-GC2063-Face-0B77 Solution Camera; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and no special configuration on the attacker side. The limiting factor is purely network exposure: the port is not internet-routable by default in properly segmented deployments, so realistic risk is bounded by whether the camera sits on a segment reachable from attacker-controlled hosts (internet-facing NVR setups, flat office LANs, or guest-Wi-Fi-adjacent IoT VLANs). No specific firmware version, vendor configuration toggle, or feature-flag is named as a precondition in the description, implying the export port is present in default builds of the affected model.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N indicates network-reachable, low-complexity, unauthenticated, no-user-interaction exploitation with high confidentiality and integrity impact, yielding a base score of 9.1 - a tier-one priority on paper. The integrity impact is presumably elevated because leaked credentials enable subsequent authenticated configuration changes, not because the export port itself writes state. EPSS and CISA KEV status were not provided in the input, so probability of in-the-wild exploitation cannot be independently quantified; the absence of KEV listing means there is no public exploit identified at time of analysis. Real-world risk is materially driven by exposure posture: cameras NATed behind firewalls are far less exposed than those reachable from the internet or untrusted segments, which is common for ICS/OT deployments tracked by CISA. Defenders should treat any internet-exposed or flat-network ZKTeco deployment as effectively compromised until the port is closed.

An attacker who has gained network reachability to a ZKTeco camera - through internet exposure, a compromised office workstation, or a flat IoT VLAN - connects directly to the undocumented configuration-export port without supplying any credentials and receives a dump containing the camera's account passwords and service inventory. The attacker then logs in through the normal management interface using the disclosed credentials to view live video, pivot to firmware modification, or move laterally to other devices sharing reused credentials. No public exploit identified at time of analysis, but the trivial nature of the bug (a single TCP connect) means weaponization is straightforward.