Description
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ZKTeco Inc. ZKTeco ZKAccess Professional
3.5.3 (Build 0005)affected
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php ↗
- https://cxsecurity.com/issue/WLB-2016080265 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116486 ↗
- https://packetstormsecurity.com/files/138566 ↗
- https://www.exploit-db.com/exploits/40323/ ↗
- https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions ↗