CVE-2016-20028: ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin
ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access when authenticated users visit attacker-controlled pages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20028?
CVE-2016-20028 is classified as a high severity vulnerability due to its potential for unauthorized administrative actions.
What types of attacks are possible with CVE-2016-20028?
CVE-2016-20028 allows attackers to execute Cross-Site Request Forgery (CSRF) to perform actions as a logged-in superadmin.
Who is affected by CVE-2016-20028?
CVE-2016-20028 affects users of ZKTeco ZKBioSecurity 3.0 where logged-in users could be exploited.
How do I fix CVE-2016-20028?
To fix CVE-2016-20028, implement anti-CSRF protections and ensure that admin actions require CSRF tokens or confirmations.
Is there a workaround for CVE-2016-20028?
A possible workaround for CVE-2016-20028 is to limit administrative access to trusted network sources only.