PT-2026-25664 · Undefined · Undefined

CVE-2016-20024 · Publicado 2026-03-15 · Atualizado 2026-06-08

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZKTeco ZKTime.Net version 3.0.1.6

Description The software contains an insecure file permissions issue that allows users with limited access to gain higher privileges. This is possible by altering executable files. Attackers can take advantage of world-writable permissions within the ZKTimeNet3.0 directory and its files to substitute legitimate executable files with malicious ones, leading to privilege escalation.

Recommendations Apply the latest security patch or update to a newer version that addresses the insecure file permissions issue. Restrict write access to the ZKTimeNet3.0 directory and its contents to authorized personnel only. Regularly audit file permissions within the ZKTimeNet3.0 directory to ensure they are appropriately configured.

Correção

LPE

Enumeração de Fraquezas

CWE-538

Identificadores relacionados

CVE-2016-20024

Produtos afetados

Undefined

Referências · 9

• https://packetstormsecurity.com/files/138565 · Nota
• https://vulncheck.com/advisories/zkteco-zktime-net-insecure-file-permissions-privilege-escalation · Nota
• https://t.me/CVEtracker/47425 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2016-20024 · Nota de Segurança
• https://exploit-db.com/exploits/40322 · Nota
• https://t.me/cveNotify/166533 · Publicação no Telegram
• https://zeroscience.mk/en/vulnerabilities/ZSL-2016-5360.php · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116487 · Nota
• https://cxsecurity.com/issue/WLB-2016080264 · Nota