← Volver a CVEs

CVE-2016-20026

CRITICAL

9.8

Descripcion

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado3/16/2026

Ultima modificacion3/16/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-798

Referencias

https://cxsecurity.com/issue/WLB-2016080266(disclosure@vulncheck.com)

https://exchange.xforce.ibmcloud.com/vulnerabilities/116484(disclosure@vulncheck.com)

https://packetstormsecurity.com/files/138567(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/40324/(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution(disclosure@vulncheck.com)

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5362.php(disclosure@vulncheck.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.