CVEvulnerability
CVE-2016-20025
8.7 HIGH
Official page ↗
- Status
- Deferred
- Published
- 2026-03-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-552
Description
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Related
Weakness · CWE (1)
- CWE-552 Files or Directories Accessible to External Parties weakness
References
- https://cxsecurity.com/issue/WLB-2016080265 cxsecurity.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116486 exchange.xforce.ibmcloud.com
- https://packetstormsecurity.com/files/138566 packetstormsecurity.com
- https://www.exploit-db.com/exploits/40323/ www.exploit-db.com
- https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions www.vulncheck.com
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php www.zeroscience.mk