CVE-2016-20025 ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
HighCVSS 8.7
EPSS 0.49%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZKTeco ZKAccess Professional | = 3.5.3 (Build 0005) | No fix listed |
References
- Zero Science Lab Disclosure third-party-advisory
- CXSecurity third-party-advisory
- IBM X-Force Exchange vdb-entry
- Packet Storm Security exploit
- Reference exploit
- VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions third-party-advisory