Low severity · published Dec 23, 2025
CVE-2021-47722
Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking authenticated users into loading the page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZA
Zucchetti Axess CLOKI Access Control · Axesstmc
1.64 · source: vendor
Affected product
ZA
Zucchetti Axess CLOKI Access Control
Axesstmc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47722
www.axesstmc.com
https://www.axesstmc.com
www.exploit-db.com
https://www.exploit-db.com/exploits/50595
www.vulncheck.com
https://www.vulncheck.com/advisories/zucchetti-axess-cloki-access-control-cross-site-request-forgery
www.zeroscience.mk
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5689.php