A stored cross-site scripting vulnerability in the ZKTeco ZKAccess Security System allows authenticated attackers to execute arbitrary scripts in the browser sessions of other users.

This is a stored cross-site scripting (XSS) vulnerability (CWE-79) triggered via the holiday_name and memo POST parameters. An authenticated attacker can inject malicious payloads that execute within the context of another user's browser session.

Successful exploitation of this vulnerability allows an attacker to compromise user browser sessions, potentially leading to unauthorized actions or the theft of sensitive session tokens. Given the administrative nature of security management systems, this could result in significant unauthorized access to physical security controls. The CVSS score of 7.2 reflects the high risk posed by potential lateral movement or persistent control over administrative interfaces.

Immediate Action: The vendor has officially discontinued ZKAccess Security System. Users must migrate to the ZKBio CVSecurity platform, which has addressed these vulnerabilities.

Proactive Monitoring: Monitor web application logs for unusual POST requests containing script tags or encoded characters in the holiday management module.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict input validation rules to block common XSS patterns in POST parameters until a full migration is completed.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the ExploitDB entry (EDB-ID 40328) and Packet Storm Security.

Because the affected product is officially discontinued and no patches will be released for the legacy ZKAccess system, the risk remains permanent. Organizations still utilizing this software must prioritize migration to the current ZKBio CVSecurity platform immediately to eliminate the exposure, as the existing XSS flaw provides a clear path for attackers to gain elevated control over security administration functions.