EUVD-2016-10815CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4Description
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
Analysis
User enumeration vulnerability in ZKTeco ZKBioSecurity 3.0 that allows unauthenticated attackers to discover valid usernames through partial character submissions to the authentication endpoint. A public proof-of-concept exploit is available, making this vulnerability actively exploitable, though it has a notably high CVSS score of 9.8 that appears inflated given the actual impact is limited to information disclosure.
Technical Context
The vulnerability affects ZKTeco ZKBioSecurity version 3.0 (CPE: cpe:2.3:a:zkteco_inc.:zkteco_zkbiosecurity:*:*:*:*:*:*:*:*), a biometric security management system. The root cause is CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization), where the authLoginAction!login.do script responds differently to partial username inputs, allowing attackers to enumerate valid accounts. This is a classic timing/response-based enumeration flaw in the authentication mechanism.
Affected Products
ZKTeco ZKBioSecurity version 3.0 and potentially all versions based on the CPE wildcard pattern. This is a biometric access control and time attendance management system commonly deployed in physical security environments. The vulnerability was discovered and reported by Zero Science Lab in 2016.
Remediation
No specific patch information is available in the provided references. Organizations should: 1) Contact ZKTeco for an updated version that addresses this vulnerability, 2) Implement rate limiting on the authentication endpoint, 3) Ensure consistent error messages regardless of username validity, 4) Monitor authentication logs for enumeration attempts. The vendor advisory link (https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction) should be consulted for official guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today