CVE-2016-20031: ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp
ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests. Attackers can exploit the EnvironmentUtil.getClientIp() method which treats IPv6 loopback address 0:0:0:0:0:0:0:1 as 127.0.0.1 and authenticates using the IP as username with hardcoded password 123456 to access sensitive information and perform unauthorized actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Until migrated, restrict access to visLogin.jsp / login endpoints so only legitimate clients can reach them, preventing attackers from spoofing localhost requests for authentication bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2016-20031?
CVE-2016-20031 has a medium severity rating due to its potential for local authorization bypass.
How do I fix CVE-2016-20031?
To fix CVE-2016-20031, update to the latest version of ZKTeco ZKBioSecurity that addresses this vulnerability.
What type of attack does CVE-2016-20031 allow?
CVE-2016-20031 allows attackers to perform local authorization bypass via spoofed localhost requests.
Which software is affected by CVE-2016-20031?
CVE-2016-20031 affects ZKTeco ZKBioSecurity version 3.0.
Can CVE-2016-20031 be exploited remotely?
CVE-2016-20031 is not a remote exploit; it requires local network access to the affected system.