Zkteco Zkbiosecurity CVE-2016-20028

The CVSS 4.3 score reflects a network-accessible vulnerability requiring low attack complexity and authenticated user privileges, with integrity impact but no confidentiality or availability impact. However, several risk signals must be evaluated together: the CVSS vector indicates this is a low-severity issue by numeric score, but the impact is significant—unauthorized creation of superadmin accounts directly violates confidentiality and integrity of the access control system itself. The attack requires user interaction (UI:N in the CVSS vector is a potential misinterpretation; CSRF inherently requires the victim to visit a page, which IS user interaction, though passive). The lack of automation requirements and high technical impact (account creation bypassing normal administrative controls) suggest this is a practical exploit, though the requirement that a legitimate admin be socially engineered to visit a malicious site somewhat limits the attack surface compared to unauthenticated RCE. Without confirmed KEV status or public POC availability data, the real-world exploitation likelihood is moderate but non-zero, especially in targeted attacks against organizations with weak security awareness. Organizations using ZKBioSecurity should treat this as a medium-priority patch—not critical infrastructure-level but requiring timely remediation within a quarterly cycle.

An attacker sends a specially crafted email to an organization's ZKBioSecurity administrator containing a link to an attacker-controlled website. When the administrator clicks the link while logged into ZKBioSecurity (perhaps in another browser tab), the attacker's page silently submits a forged HTTP request to the ZKBioSecurity application server creating a new superadmin account under the attacker's control, all without the administrator's explicit knowledge. The attacker can then log in directly to ZKBioSecurity with the newly created credentials, gaining persistent administrative access to modify access rules, disable audit logs, add/remove employees from access control lists, and potentially extract biometric data or employee information.