Title: iTA 7 terminals (except G2) – hard-coded credentials
Published: 2026-10-23
Last updated: 2026-10-23
Severity: Critical
Summary
The web interface of iTA 7 attendance terminals (all models except G2) contains hard-coded service credentials that are the same on all devices and cannot be changed or disabled by the customer. An attacker who knows these credentials and has network access to the terminal can log in to the web interface with service privileges. Some of the affected terminals additionally contain a fixed password for the administrative (root) account, which allows remote login with full control of the device. The affected products are no longer supported, and no security update will be provided.
Affected products
All iTA 7 attendance terminals whose type designation does not end with “G2”, in all hardware and firmware versions. Some of these terminals were sold under the name ZWS terminal or ZWS Pro; they are affected as well.
| Order code | Product series | Product name |
|---|---|---|
| 098756 | iTA 7 | iTA 7 G terminal – no reader + FPC black-silver |
| 092217 | iTA 7 | iTA 7 G terminal – no reader black-silver |
| 092196 | iTA 7 | iTA 7 G terminal – RFID 1200-A black-silver |
| 092197 | iTA 7 | iTA 7 G terminal – RFID 2000-A black-silver |
| 091656 | iTA 7 | iTA 7 G terminal – RFID EM4100 black-silver |
| 081786 | iTA 7 | iTA 7 G terminal – RFID EM4100 black-silver IP65 |
| 081785 | iTA 7 | iTA 7 G terminal – RFID EM4100.WiFi black-silver IP65 |
| 091651 | iTA 7 | iTA 7 G terminal – RFID Hitag 2 black-silver |
| 091647 | iTA 7 | iTA 7 G terminal – RFID Hitag 2 E black-silver |
| 091650 | iTA 7 | iTA 7 G terminal – RFID Hitag2 E + Mifare black-silver |
| 091653 | iTA 7 | iTA 7 G terminal – RFID ICODE black-silver |
| 086473 | iTA 7 | iTA 7 G terminal – RFID JA125 Mifare black-silver |
| 081754 | iTA 7 | iTA 7 G terminal – RFID Mifare black-silver IP65 |
| 082671 | iTA 7 | iTA 7 G terminal – RFID Mifare black-silver WiFi |
| 081755 | iTA 7 | iTA 7 G terminal – RFID Mifare.WiFi black-silver IP65 |
| 091652 | iTA 7 | iTA 7 G terminal – RFID Multi1 black-silver |
| 091655 | iTA 7 | iTA 7 G terminal – RFID Multi2 black-silver |
| 092195 | iTA 7 | iTA 7 G terminal – RFID+FPC Mifare black-silver |
| 091654 | iTA 7 | iTA 7 G terminal – RFID+FPO Mifare black-silver |
| 092537 | iTA 7 | iTA 7 IP54 terminal – iButton |
| 092517 | iTA 7 | iTA 7 IP54 terminal – RFID Mifare |
| 096226 | iTA 7 | iTA 7 terminal – EMV black-silver |
| 094271 | iTA 7 | iTA 7 terminal – iButton + FPC Mifare black-silver |
| 095791 | iTA 7 | iTA 7 terminal – iButton black-silver |
| 094677 | iTA 7 | iTA 7 terminal – no reader + FPC black-silver |
| 099794 | iTA 7 | iTA 7 terminal – no reader + FPC black-silver |
| 092218 | iTA 7 | iTA 7 terminal – no reader black-silver |
| 095638 | iTA 7 | iTA 7 terminal – RFID 1200-A + FPC black-silver |
| 092193 | iTA 7 | iTA 7 terminal – RFID 1200-A black-silver |
| 092194 | iTA 7 | iTA 7 terminal – RFID 2000-A black-silver |
| 095606 | iTA 7 | iTA 7 terminal – RFID EM4100 + FPC Mifare black-silver |
| 099185 | iTA 7 | iTA 7 terminal – RFID EM4100 + FPC WiFi black-silver |
| 091485 | iTA 7 | iTA 7 terminal – RFID EM4100 black-silver |
| 702997 | iTA 7 | iTA 7 terminal – RFID Hitag 2 black-silver |
| 091638 | iTA 7 | iTA 7 terminal – RFID Hitag 2 E black-silver |
| 091641 | iTA 7 | iTA 7 terminal – RFID Hitag2 E + Mifare black-silver |
| 091644 | iTA 7 | iTA 7 terminal – RFID ICODE black-silver |
| 094438 | iTA 7 | iTA 7 terminal – RFID JA125 + FPC Mifare black-silver |
| 096201 | iTA 7 | iTA 7 terminal – RFID JA125 Mifare black-silver |
| 092192 | iTA 7 | iTA 7 terminal – RFID MIfare + FPC Mifare black-silver |
| 096054 | iTA 7 | iTA 7 terminal – RFID MIfare + FPC WiFi black-silver |
| 702996 | iTA 7 | iTA 7 terminal – RFID Mifare black-silver |
| 702998 | iTA 7 | iTA 7 terminal – RFID Mifare silver |
| 091643 | iTA 7 | iTA 7 terminal – RFID Multi1 black-silver |
| 091645 | iTA 7 | iTA 7 terminal – RFID Multi2 black-silver |
| 706070 | iTA 7 | iTA 7 terminal – RFID+FPO Mifare black-silver |
| 091649 | iTA 7 | ZWS Pro 40.10 – RFID Mifare.black-silver |
| 702992 | iTA 7 | ZWS terminal – RFID Hitag 2 black |
| 703157 | iTA 7 | ZWS terminal – RFID Hitag 2 grey |
| 702999 | iTA 7 | ZWS terminal – RFID Hitag 2 silver |
| 702991 | iTA 7 | ZWS terminal – RFID Mifare black |
| 703158 | iTA 7 | ZWS terminal – RFID Mifare grey |
| 092928 | iTA 7 | ZWS terminal – RFID Mifare, HID Class black silver |
| 706098 | iTA 7 | ZWS terminal – RFID Mifare, HID Class grey |
Fixed version: none. These products are no longer supported, and no security update will be provided.
Products not affected
iTA 7 G2 terminals are not affected, because they do not contain the affected web interface. The type designation on the type label of G2 terminals ends with G2, for example “iTA 7 G terminal – RFID EM4100 black-silver G2”.
Order codes of G2 products: 021341, 023095, 085193, 085194, 085195, 085196, 085197, 085198, 087322, 088309, 088578, 088579, 088844, 089334, 089335.
Terminals whose type designation does not end with “G2”, for example “iTA 7 G terminal – RFID EM4100 black-silver”, are affected.
Description
For service purposes, the web interface accepts a set of fixed service credentials. The credentials are identical on all affected terminals. They are stored in the firmware of the device and cannot be changed or disabled through the configuration.
Some of the affected terminals additionally use the same password for the administrative (root) account on all devices. This account can be used through remote login services that are always enabled on the terminal. The password cannot be changed by the customer in a supported way.
Security impact
An attacker who logs in with the service credentials gains full access to the web interface of the terminal. The attacker can:
- read the configuration and data of the terminal, including employee data and card identifiers;
- export and import the configuration of the terminal;
- change the network configuration, users and passwords of the web interface;
- make the terminal unavailable through an invalid configuration;
- on terminals with the fixed administrative password: take full control of the device, including the relay output; where the relay is connected to a door, open the door.
Conditions for exploitation:
- network access to the web interface or to the remote login services of the terminal;
- knowledge of the credentials.
Changing the passwords of the regular web interface users does not prevent this attack.
Resolution
The affected products are no longer supported. No security update will be provided.
We recommend replacing the affected terminals with the currently supported iTA 7 G2 terminal. For a replacement offer, please contact your supplier or our sales department: ita@mobatime.cz.
Mitigation
- Block all incoming network connections to the terminal using a firewall, access control lists, or a separate VLAN. This includes the web interface (TCP port 80) and any other services running on the terminal. Incoming connections are only needed to configure the terminal. If configuration is needed, allow access to the web interface only from one dedicated management workstation and only for the duration of the configuration.
- Allow only outgoing connections from the terminal to the time and attendance server (TCP port 443, or TCP port 80 in some installations). This is a separate firewall rule. The terminal does not need any incoming connections for normal operation.
- Never expose the terminal to the internet.
- Place the terminal in a separate network segment.
The same measures also mitigate ELEKON-SA-2026-001.
References
Revision history
| Date | Revision | Description |
|---|---|---|
| 2026-10-23 | 1.0 | Initial publication |