ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

Published 7 mo ago 2026-03-15 · modified 3 mo ago 2026-07-28 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.8%

percentile 57%

Public exploits

none known

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: total
Assessed: 7 mo ago 2026-03-16

Exploit prediction (EPSS)

0.81% probability of exploitation in the next 30 days, higher than 57% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

ZKTeco Inc. ZKTeco ZKBioSecurity

Classification

Weakness

CWE-798 Use of Hard-coded Credentials

References

zeroscience.mk /en/vulnerabilities/ZSL-2016-5362.php · third-party-advisory
cxsecurity.com /issue/WLB-2016080266 · third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/116484 · vdb-entry
packetstormsecurity.com /files/138567 · exploit
exploit-db.com /exploits/40324/ · exploit
vulncheck.com /advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution · third-party-advisory

Sources

CVE List: CVE-2016-20026
NVD: CVE-2016-20026

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary