EUVD-2016-10805Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling File access restriction
MITRE ATT&CK
2 techniques across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a severe vulnerability with network attack vector, low complexity, and requiring only low privileges. The availability of multiple public exploits (exploit-db #40323, PacketStorm #138566) significantly increases real-world risk. While not listed in CISA KEV and lacking EPSS data, the combination of low attack complexity, public exploits, and the critical nature of access control systems makes this a high-priority issue. The vulnerability affects confidentiality, integrity, and availability equally (all High), suggesting complete system compromise is possible. |
| Exploit ScenarioDerived | An attacker with valid but low-privileged credentials on a system running ZKAccess Professional 3.5.3 can locally or remotely (if remote access is available) navigate to the application installation directory. They can then replace legitimate executable files with malicious binaries due to the excessive Modify permissions. When the application or service restarts, or another user launches the replaced executable, the malicious code executes with elevated privileges, potentially giving the attacker full system control. Public exploits demonstrate this attack path is well-documented and easily reproducible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Privilege escalation vulnerability in ZKTeco ZKAccess Professional 3.5.3 (Build 0005) where authenticated users can modify executable files due to insecure permissions, allowing them to replace binaries with malicious code and gain elevated privileges. Multiple public exploits are available (exploit-db, PacketStorm) making this a high-risk vulnerability for organizations using this access control software, despite no current KEV listing or EPSS data.
RemediationAI
No specific patch information is available in the provided references. Organizations should: 1) Contact ZKTeco for an updated version that addresses the file permission issue, 2) Implement compensating controls by manually correcting file permissions to remove Modify rights for Authenticated Users on executable files, 3) Monitor for unauthorized modifications to application binaries, 4) Restrict local access to systems running ZKAccess Professional to trusted administrators only. The vendor advisory link (https://www.vulncheck.com/advisories/zkteco-zkaccess-professional-privilege-escalation-via-insecure-permissions) may contain additional mitigation details.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ZKTeco ZKAccess Professional (CPE: cpe:2.3:a:zkteco_inc.:zkteco_zkaccess_professional:*:*:*:*:*:*:*:*) is an access control management software that suffers from CWE-552 (Files or Directories Accessible to External Parties). The vulnerability stems from improper file permissions where the 'Authenticated Users' Windows group has Modify permissions on executable files within the application directory. This allows any authenticated user on the system to replace legitimate executables with malicious binaries that will execute with the privileges of the service or user running the application.
Know when Zkteco Zkaccess Professional gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.
Executive ViewAI
ZKAccess Professional 3.5.3 contains a critical privilege escalation vulnerability affecting all authenticated users of the access control system. Without immediate mitigation, attackers with valid credentials can gain administrative control over the entire access control infrastructure, potentially compromising physical security, audit logs, and system integrity across the organization.
Restrict modify/write permissions on executable directories to administrative accounts only; implement file integrity monitoring (FIM) on all ZKAccess executable and configuration directories; deploy application whitelisting to prevent unauthorized binary execution; segment ZKAccess systems from general network; increase authentication requirements and implement MFA where supported; audit and revoke unnecessary Authenticated Users permissions; monitor for suspicious file modifications and privilege escalation attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC