{"id":"CVE-2016-20030","state":"PUBLISHED","title":"ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction","description":"ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.","publishedAt":"2026-03-15T13:35:32.348Z","updatedAt":"2026-07-28T01:46:29.992Z","severity":{"score":9.3,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["ZKTeco Inc. ZKTeco ZKBioSecurity"],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKBioSecurity","versions":[{"version":"3.0.1.0_R_230","status":"affected"}]}],"references":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5366.php","https://exchange.xforce.ibmcloud.com/vulnerabilities/116485","https://packetstormsecurity.com/files/138573","https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction"],"weaknesses":["CWE-551"],"ingestedAt":"2026-10-29T19:42:36.310Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2016/20xxx/CVE-2016-20030.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2016-20030","state":"PUBLISHED","datePublished":"2026-03-15T13:35:32.348Z","dateUpdated":"2026-07-28T01:46:29.992Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-03-15T12:37:09.340Z"},"containers":{"cna":{"title":"ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction","descriptions":[{"lang":"en","value":"ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses."}],"affected":[{"vendor":"ZKTeco Inc.","product":"ZKTeco ZKBioSecurity","versions":[{"version":"3.0.1.0_R_230","status":"affected"}]}],"references":[{"url":"https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5366.php","name":"Zero Science Lab Disclosure","tags":["third-party-advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/116485","name":"IBM X-Force Exchange","tags":["vdb-entry"]},{"url":"https://packetstormsecurity.com/files/138573","name":"Packet Storm Security","tags":["exploit"]},{"url":"https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction","name":"VulnCheck Advisory: ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":9.3,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-551","lang":"en","description":"Incorrect Behavior Order: Authorization Before Parsing and Canonicalization","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-28T01:46:29.992Z"},"datePublic":"2016-08-31T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zkteco:zkbiosecurity_server:3.0.1.0_r_230:*:*:*:*:*:*:*"}]}]}],"credits":[{"lang":"en","value":"LiquidWorm as Gjoko Krstic of Zero Science Lab","type":"finder"}],"x_generator":{"engine":"vulncheck"},"solutions":[{"lang":"en","value":"The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks."}],"tags":["unsupported-when-assigned"]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2016-20030","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-03-16T14:14:00.622167Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-16T14:20:20.095Z"}}]}}}