Skip to content
CVE Tracker
Back

CVE-2016-20029

ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability

Medium6.9EPSS 0.21%
Published
Updated
Reserved
Assigned by
VulnCheck

Description

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameters to bypass access controls and retrieve sensitive information including configuration files, source code, and protected application resources.

Scores

CVSS scores of CVE-2016-20029, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0Medium6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
VulnCheckCNA (assigner)3.1Medium6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Deferred4.0Medium6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.21% · top 88% of all CVEs (2 Nov 2026)
CISA SSVC
Exploitation: poc · Automatable: no · Technical impact: partial

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

Affected products

  • ZKTeco Inc. · ZKTeco ZKBioSecurity

    • affected 3.0.1.0_R_230

What to do

Solution: The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks.

References (6)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .