CVE-2026-8598

An undocumented configuration export port is accessible on some models 
of ZKTeco CCTV cameras. This port does not require authentication and 
exposes critical information about the camera such as open services and 
camera account credentials.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-139-04.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-139-04
https://www.zkteco.com/en/announcement/23