CVE-2016-20025: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20025?
CVE-2016-20025 is classified as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2016-20025?
Fixing CVE-2016-20025 involves reviewing and correcting the file permissions associated with executable files in ZKTeco ZKAccess Professional 3.5.3.
Who is affected by CVE-2016-20025?
Authenticated users of ZKTeco ZKAccess Professional 3.5.3 are affected by CVE-2016-20025.
What type of vulnerability is CVE-2016-20025?
CVE-2016-20025 is a privilege escalation vulnerability due to insecure file permissions.
Can attackers exploit CVE-2016-20025 remotely?
CVE-2016-20025 requires authenticated access, so attackers must first gain legitimate user credentials to exploit the vulnerability.