EUVD-2016-10807Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents extremely high real-world risk based on multiple factors: CVSS 9.8 indicates network-exploitable (AV:N), low complexity (AC:L), no authentication required (PR:N), with full CIA impact. The availability of multiple public exploits (Exploit-DB #40324, Packet Storm #138567) makes exploitation trivial. While not currently in CISA KEV and lacking EPSS data, the combination of unauthenticated remote code execution with SYSTEM privileges, public exploits, and ease of automation makes this a critical priority. The SSVC framework would classify this as 'Act' given the public exploit availability, full automation potential, and total system compromise impact. |
| Exploit ScenarioDerived | An attacker scans for exposed ZKBioSecurity installations on the internet, identifies the Tomcat manager interface (typically on port 8080), authenticates using the hardcoded credentials from tomcat-users.xml, uploads a malicious WAR file containing a JSP web shell, and gains SYSTEM-level command execution on the Windows server. The public exploits automate this entire process, making it accessible to low-skilled attackers. Given the biometric security nature of the application, compromise could lead to physical security breaches, identity theft, and lateral movement into corporate networks. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Critical hardcoded credentials vulnerability in ZKTeco ZKBioSecurity 3.0's bundled Apache Tomcat server that allows unauthenticated remote attackers to upload malicious WAR files and execute arbitrary code with SYSTEM privileges. Multiple public exploits are available (Exploit-DB, Packet Storm), making this a high-risk vulnerability for organizations using this biometric security management software.
RemediationAI
No specific patch information is available in the provided references. Immediate actions include: 1) Disable or restrict network access to the Tomcat manager application, 2) Change the default credentials in tomcat-users.xml if possible, 3) Consider upgrading to a newer version of ZKBioSecurity if available, 4) Implement network segmentation to limit exposure of the management interface. Contact ZKTeco for vendor-specific patches or updates. The VulnCheck advisory (https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-hardcoded-credentials-remote-code-execution) may contain additional remediation details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from hardcoded credentials in the tomcat-users.xml configuration file of the bundled Apache Tomcat server within ZKTeco ZKBioSecurity (CPE: cpe:2.3:a:zkteco_inc.:zkteco_zkbiosecurity:*:*:*:*:*:*:*:*). This is a classic CWE-798 (Use of Hard-coded Credentials) issue where default credentials are embedded in the application distribution. The affected version 3.0.1.0_R_230 includes a Tomcat manager application accessible with these static credentials, allowing attackers to deploy arbitrary Java web applications (WAR files) containing malicious JSP code.
Know when Zkteco Zkbiosecurity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload malicious WAR archives containing JSP applications and execute arbitrary code with SYSTEM privileges.
Executive ViewAI
ZKTeco ZKBioSecurity 3.0 systems contain hardcoded administrative credentials that allow attackers to bypass authentication and execute malicious code with full system privileges. Any organization running this software faces immediate risk of complete system compromise and potential lateral movement across networked infrastructure.
Restrict network access to Tomcat manager application (port 8080/8443) using firewall rules and WAF; disable the Tomcat manager application entirely if not operationally required; implement intrusion detection/prevention rules to detect WAR file uploads and JSP execution attempts; enforce strict egress filtering; monitor process execution for unexpected Tomcat child processes; implement application whitelisting on affected hosts; segment biometric systems from critical infrastructure networks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
GitHub PoC