Description
ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests. Attackers can exploit the EnvironmentUtil.getClientIp() method which treats IPv6 loopback address 0:0:0:0:0:0:0:1 as 127.0.0.1 and authenticates using the IP as username with hardcoded password 123456 to access sensitive information and perform unauthorized actions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
ZKTeco Inc. ZKTeco ZKBioSecurity
3.0.1.0_R_230affected
References
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5367.php ↗
- https://cxsecurity.com/issue/WLB-2016090003 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116488 ↗
- https://packetstormsecurity.com/files/138571 ↗
- https://www.exploit-db.com/exploits/40327/ ↗
- https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-local-authorization-bypass-via-vislogin-jsp ↗