EUVD-2016-10815Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V5 - File Handling Directory indexing prevention
|
| Impact | Despite the extreme CVSS 9.8 score (indicating high confidentiality, integrity, and availability impact), the actual risk is significantly lower as this is purely an information disclosure vulnerability. The CVSS vector shows network-accessible with no authentication required (AV:N/AC:L/PR:N/UI:N), which is accurate, but the C:H/I:H/A:H impact ratings are misleading - user enumeration doesn't directly compromise data integrity or availability. With a public POC available since 2016 (PacketStorm) and no KEV listing, this represents a moderate risk primarily useful for reconnaissance in targeted attacks rather than direct compromise. |
| Exploit ScenarioDerived | An attacker can remotely access the authLoginAction!login.do endpoint without authentication and submit sequential username patterns (e.g., 'a', 'ad', 'adm', 'admi', 'admin') while observing response differences to enumerate valid accounts. A public exploit is available on PacketStorm (https://packetstormsecurity.com/files/138573) automating this process. Once valid usernames are discovered, attackers can launch targeted password attacks or social engineering campaigns against identified users. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
User enumeration vulnerability in ZKTeco ZKBioSecurity 3.0 that allows unauthenticated attackers to discover valid usernames through partial character submissions to the authentication endpoint. A public proof-of-concept exploit is available, making this vulnerability actively exploitable, though it has a notably high CVSS score of 9.8 that appears inflated given the actual impact is limited to information disclosure.
RemediationAI
No specific patch information is available in the provided references. Organizations should: 1) Contact ZKTeco for an updated version that addresses this vulnerability, 2) Implement rate limiting on the authentication endpoint, 3) Ensure consistent error messages regardless of username validity, 4) Monitor authentication logs for enumeration attempts. The vendor advisory link (https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction) should be consulted for official guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects ZKTeco ZKBioSecurity version 3.0 (CPE: cpe:2.3:a:zkteco_inc.:zkteco_zkbiosecurity:*:*:*:*:*:*:*:*), a biometric security management system. The root cause is CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization), where the authLoginAction!login.do script responds differently to partial username inputs, allowing attackers to enumerate valid accounts. This is a classic timing/response-based enumeration flaw in the authentication mechanism.
Know when Zkteco Zkbiosecurity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
Executive ViewAI
ZKTeco ZKBioSecurity 3.0 deployments face a critical, actively exploited vulnerability that enables attackers to enumerate valid user accounts without authentication, creating a foundation for targeted credential attacks and unauthorized system access. Organizations using this biometric security platform are at immediate risk of account compromise and potential physical security bypass.
Implement Web Application Firewall (WAF) rules to block requests to authLoginAction!login.do or rate-limit submissions to the username parameter; restrict network access to ZKBioSecurity administrative interfaces using IP whitelisting and VPN-only requirements; disable the affected login functionality if alternative authentication methods exist; implement intrusion detection signatures to monitor for username enumeration attempts; consider air-gapping the system or segmenting it to a restricted network until patch availability is confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB