What’s Vulnerable › Vulnerabilities

CVE-2016-20025: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-16 · updated 2026-06-17
• Weakness: CWE-552

Description

ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.

Affected products

• ZKTeco Inc. ZKTeco ZKAccess Professional: 3.5.3 (Build 0005)

References

• https://cxsecurity.com/issue/WLB-2016080265
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116486
• https://packetstormsecurity.com/files/138566
• https://www.exploit-db.com/exploits/40323/
• https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php

Get alerted when CVE-2016-20025 or the next vulnerability affects your stack