CISA’s advisory on ZKTeco CCTV Cameras highlights why physical security devices must be managed with the same discipline as core IT infrastructure. The issue affects the SSC335-GC2063-Face-0b77 solution, where vulnerabilities may allow authentication bypass leading to full administrative control, and unauthorized triggering of abnormal upgrades that could cause instability or forced restarts. In surveillance environments, this is not just a device security issue; it can directly affect visibility, monitoring continuity, and facility safety.

Organizations using affected ZKTeco camera solutions should immediately verify firmware versions, obtain the vendor patch, restrict camera management access, segment CCTV networks from business systems, and monitor for unauthorized configuration changes or unexpected reboots. CCTV cameras are often treated as “set and forget” devices, which is charmingly optimistic and technically reckless. Once attackers gain admin control over surveillance equipment, they can potentially blind monitoring, pivot into adjacent networks, or manipulate physical security visibility.

View CSAF Summary Successful exploitation of this vulnerability could result in information disclosure, including capture of camera account credentials. The following versions of ZKTeco CCTV Cameras are affected: SSC335-GC2063-Face-0b77 Solution CVSS Vendor Equipment Vulnerabilities v3 9.1 ZKTeco ZKTeco CCTV Cameras Authentication Bypass Using an Alternate Path or Channel Background Critical Infrastructure Sectors: Commercial Facilities Countries/Areas Deployed: Worldwide Company Headquarters Location: China Vulnerabilities Expand All + CVE-2026-8598 An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials. View CVE Details Affected Products ZKTeco CCTV Cameras Vendor: ZKTeco Product Version: ZKTeco SSC335-GC2063-Face-0b77 Solution:

Source: ZKTeco CCTV Cameras via CISA Advisories — published 19 May 2026.