{"id":"CVE-2016-20026","state":"PUBLISHED","title":"ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution","description":"ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.","publishedAt":"2026-03-15T13:35:16.754Z","updatedAt":"2026-07-28T01:46:27.291Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ZKTeco Inc. ZKTeco ZKBioSecurity"],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKBioSecurity","versions":[{"version":"3.0.1.0_R_230","status":"affected"}]}],"references":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php","https://cxsecurity.com/issue/WLB-2016080266","https://exchange.xforce.ibmcloud.com/vulnerabilities/116484","https://packetstormsecurity.com/files/138567","https://www.exploit-db.com/exploits/40324/","https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution"],"weaknesses":["CWE-798"],"ingestedAt":"2026-10-29T19:42:36.310Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/20xxx/CVE-2016-20026.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-20026","state":"PUBLISHED","datePublished":"2026-03-15T13:35:16.754Z","dateUpdated":"2026-07-28T01:46:27.291Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-03-15T12:36:32.692Z"},"containers":{"cna":{"title":"ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution","descriptions":[{"lang":"en","value":"ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges."}],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKBioSecurity","versions":[{"version":"3.0.1.0_R_230","status":"affected"}]}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php","name":"Zero Science Lab Disclosure","tags":["third-party-advisory"]},{"url":"https://cxsecurity.com/issue/WLB-2016080266","name":"CXSecurity","tags":["third-party-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/116484","name":"IBM X-Force Exchange","tags":["vdb-entry"]},{"url":"https://packetstormsecurity.com/files/138567","name":"Packet Storm Security","tags":["exploit"]},{"url":"https://www.exploit-db.com/exploits/40324/","name":"Reference","tags":["exploit"]},{"url":"https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution","name":"VulnCheck Advisory: ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-798","lang":"en","description":"Use of Hard-coded Credentials","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-28T01:46:27.291Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zkteco:zkbiosecurity_server:3.0.1.0_r_230:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"},"datePublic":"2016-08-31T00:00:00.000Z","solutions":[{"lang":"en","value":"The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks."}],"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-20026","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-03-16T14:15:30.366324Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-16T14:20:20.775Z"}}]}}}