ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

Published 7 mo ago 2026-03-15 · modified 3 mo ago 2026-07-28 · JSON

CVSS

9.8

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.6%

percentile 48%

Public exploits

none known

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.

CISA SSVC assessment

Exploitation: Proof of concept public
Automatable: yes
Technical impact: partial
Assessed: 7 mo ago 2026-03-16

Exploit prediction (EPSS)

0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	4.0	9.3	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

ZKTeco Inc. ZKTeco ZKBioSecurity

Classification

Weakness

CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

References

zeroscience.mk /en/vulnerabilities/ZSL-2016-5366.php · third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/116485 · vdb-entry
packetstormsecurity.com /files/138573 · exploit
vulncheck.com /advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction · third-party-advisory

Sources

CVE List: CVE-2016-20030
NVD: CVE-2016-20030

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary