CVE-2016-20031 ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp
MediumCVSS 6.8
EPSS 0.17%
- Published
- Updated
- Exploit status
- No public exploit known
Description
ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests. Attackers can exploit the EnvironmentUtil.getClientIp() method which treats IPv6 loopback address 0:0:0:0:0:0:0:1 as 127.0.0.1 and authenticates using the IP as username with hardcoded password 123456 to access sensitive information and perform unauthorized actions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ZKTeco ZKBioSecurity | = 3.0.1.0_R_230 | No fix listed |
References
- Zero Science Lab Disclosure third-party-advisory
- CXSecurity third-party-advisory
- IBM X-Force Exchange vdb-entry
- Packet Storm Security exploit
- Reference exploit
- VulnCheck Advisory: ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp third-party-advisory