CVE-2016-20029 | BDVDB-2026-320579 Detail
ZKTecoZKTeco ZKBioSecurity
Description#
ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameters to bypass access controls and retrieve sensitive information including configuration files, source code, and protected application resources.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact none, availability impact none. Attack vector: local.
Weaknesses#
- CWE-276 Incorrect Default Permissions
References#
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5365.php
- https://cxsecurity.com/issue/WLB-2016090001
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116489
- https://packetstormsecurity.com/files/138570
- https://www.exploit-db.com/exploits/40326/
- https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-file-path-manipulation-vulnerability
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.