ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager

APACHE

ZKTECO

16-03-2026 11:20

CVE-2016-20026 Vulnerabilidad documentada

Sin puntuación

Tags

#apache

#server

#zkteco

#application

#attackers

#authenticated

#arbitrary

#security

#privilege

#malicious

#execute

#allow

#attack

#access

Descripción

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access manager application. Attackers can authenticate with stored tomcat-users.xml upload malicious WAR archives containing JSP applications and execute arbitrary code SYSTEM privileges.

https://cxsecurity.com/issue/WLB-2016080266

https://exchange.xforce.ibmcloud.com/vulnerabilities/116484

https://packetstormsecurity.com/files/138567

https://www.exploit-db.com/exploits/40324/

https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php

Referencia

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2016-20026

Resultados similares

Coincidentes en almenos en 50% de los tags

16-03-2026 CVE-2016-20032
ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that...
Ver información

16-03-2026 CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp th...
Ver información