CVE-2016-20026

CRITICAL

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

Title source: cna

Description

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

Exploits (1)

exploitdb WRITEUP

by LiquidWorm · textwebappsjsp

https://www.exploit-db.com/exploits/40324

View Code ZIP pw:eip

References (6)

[Third Party Advisory] https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php

[Third Party Advisory] https://cxsecurity.com/issue/WLB-2016080266

[Vdb Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/116484

[Exploit] https://packetstormsecurity.com/files/138567

[Exploit] https://www.exploit-db.com/exploits/40324/

[Third Party Advisory] https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution

Scores

CVSS v3 9.8

EPSS 0.0007

EPSS Percentile 21.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-798

Status published

Products (1)

ZKTeco Inc./ZKTeco ZKBioSecurity 3.0.1.0_R_230

Published Mar 16, 2026

Tracked Since Mar 16, 2026