PT-2026-25665 · Undefined · Undefined

Published 2026-03-15 · Updated 2026-06-08 · CVE-2016-20025

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ZKTeco ZKAccess Professional version 3.5.3

Description The software contains an insecure file permissions issue that allows authenticated users to escalate privileges. Attackers can exploit the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code, leading to privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2016-20025

Affected Products

Undefined

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-20025 · Security Note
• https://packetstormsecurity.com/files/138566 · Note
• https://vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions · Note
• https://t.me/CVEtracker/47426 · Telegram Post
• https://exploit-db.com/exploits/40323 · Note
• https://cxsecurity.com/issue/WLB-2016080265 · Note
• https://zeroscience.mk/en/vulnerabilities/ZSL-2016-5361.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/116486 · Note
• https://t.me/cveNotify/166534 · Telegram Post