Vulnerabilities CVE-2016-20026

CVE-2016-20026

Critical

Open

TLP:CLEAR

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.

Details

CVSS Score: 9.3
EPSS Score ⓘ: 0.78%

52.7th percentile
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Confidence: 90%
Published: Mar 15, 2026
Last Modified: Jul 28, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.