Vulnerability in Zkteco Inc. Zkaccess Professional
CVE-2016-20025
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authen…
EPSS: 0.000 (9.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Zkteco Inc. Zkaccess Professional — versions 3.5.3 (Build 0005)
Weakness classification (CWE)
References
- Zero Science Lab Disclosure (third-party-advisory)
- CXSecurity (third-party-advisory)
- IBM X-Force Exchange (vdb-entry)
- Packet Storm Security (exploit)
- Reference (exploit)
- VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions (third-party-advisory)
Frequently asked questions
- What is CVE-2016-20025?
- CVE-2016-20025 is a high-severity vulnerability in Zkteco Inc. Zkaccess Professional, classified under Files or Directories Accessible to External Parties. CVSS score: 8.8/10. Published 2026-03-15.
- How severe is CVE-2016-20025?
- High severity. CVSS v3 base score is 8.8 out of 10.