{"id":"CVE-2016-20025","state":"PUBLISHED","title":"ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions","description":"ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.","publishedAt":"2026-03-15T13:35:13.072Z","updatedAt":"2026-06-08T15:11:22.251Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ZKTeco Inc. ZKTeco ZKAccess Professional"],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKAccess Professional","versions":[{"version":"3.5.3 (Build 0005)","status":"affected"}]}],"references":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php","https://cxsecurity.com/issue/WLB-2016080265","https://exchange.xforce.ibmcloud.com/vulnerabilities/116486","https://packetstormsecurity.com/files/138566","https://www.exploit-db.com/exploits/40323/","https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions"],"weaknesses":["CWE-552"],"ingestedAt":"2026-10-29T19:42:36.310Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/20xxx/CVE-2016-20025.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-20025","state":"PUBLISHED","datePublished":"2026-03-15T13:35:13.072Z","dateUpdated":"2026-06-08T15:11:22.251Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-03-15T12:36:13.750Z"},"containers":{"cna":{"title":"ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions","descriptions":[{"lang":"en","value":"ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation."}],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKAccess Professional","versions":[{"version":"3.5.3 (Build 0005)","status":"affected"}]}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php","name":"Zero Science Lab Disclosure","tags":["third-party-advisory"]},{"url":"https://cxsecurity.com/issue/WLB-2016080265","name":"CXSecurity","tags":["third-party-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/116486","name":"IBM X-Force Exchange","tags":["vdb-entry"]},{"url":"https://packetstormsecurity.com/files/138566","name":"Packet Storm Security","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/40323/","name":"Reference","tags":["exploit"]},{"url":"https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions","name":"VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-552","lang":"en","description":"Files or Directories Accessible to External Parties","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-06-08T15:11:22.251Z"},"datePublic":"2016-08-30T00:00:00.000Z","credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"},"solutions":[{"lang":"en","value":"The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks."}],"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-20025","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-16T14:15:40.818968Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-16T14:20:21.010Z"}}]}}}