Security readout for executives and security teams
Plain-English summary
This flaw affects named ZKTeco biometric access-control products and could let an attacker abuse reused tokens to create or delete users, make users administrators, and download stored face data. That creates business risk around physical access control, identity records, and biometric privacy.
Executive priority
Treat as high priority for sites using the named biometric access-control products, especially if remotely reachable. The potential impact includes administrator takeover and biometric data exposure, but available evidence does not confirm active exploitation or a published fix.
Technical view
CVE-2020-17474 is described as a token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723. Reported impacts include arbitrary user creation, administrator elevation, user deletion, and downloading user faces from the database. No CVSS, CWE, CPE list, or vendor fix is present in the bundle.
Likely exposure
Exposure is most likely where the named ZKTeco FaceDepot or ZKBiosecurity Server versions are deployed for biometric or access-control administration. The bundle does not identify broader affected versions or CPEs.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The described impact is serious because token reuse may enable privileged account and biometric-data actions if an attacker can reach and abuse the affected service.
Researcher notes
The record is sparse: no CVSS vector, CWE, CPEs, patch details, or exploit-status evidence are included. Analysis should stay anchored to the named versions and observed administrative and biometric-data impacts until vendor or additional advisory data is available.
Mitigation direction
- Check ZKTeco and advisory sources for official patch or upgrade guidance.
- Remove public internet exposure from affected management interfaces.
- Restrict access to trusted administrator networks and accounts.
- Review and rotate relevant sessions or tokens where supported.
- Increase monitoring for user, administrator, and face-data access changes.
Validation and detection
- Inventory FaceDepot 7B and ZKBiosecurity Server deployments and versions.
- Confirm whether versions match 1.0.213 or 1.0.0_20190723.
- Check whether management services are externally reachable.
- Review logs for unexpected user creation, deletion, admin elevation, or face downloads.
- Document vendor guidance status and remediation owner.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupDatabase behavior lookup
The CVE wording references database injection or access, so collection and exfiltration review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-17474 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.