CVE-2016-20025
ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
- State
- Published
- Severity
- 8.7 High
- Published
- Mar 15, 2026
- Updated
- Jun 8, 2026
- Reserved
- Mar 15, 2026
Description
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-552 Files or Directories Accessible to External Parties
Affected Products
| Product | Versions |
|---|---|
ZKTeco ZKAccess ProfessionalZKTeco Inc. |
|
References
- Zero Science Lab Disclosurethird-party-advisory
- CXSecuritythird-party-advisory
- IBM X-Force Exchangevdb-entry
- Packet Storm Securityexploit
- Referenceexploit
- VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissionsthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.