EUVD-2016-10815CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
5DescriptionNVD
ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
AnalysisAI
User enumeration vulnerability in ZKTeco ZKBioSecurity 3.0 that allows unauthenticated attackers to discover valid usernames through partial character submissions to the authentication endpoint. A public proof-of-concept exploit is available, making this vulnerability actively exploitable, though it has a notably high CVSS score of 9.8 that appears inflated given the actual impact is limited to information disclosure.
Technical ContextAI
The vulnerability affects ZKTeco ZKBioSecurity version 3.0 (CPE: cpe:2.3:a:zkteco_inc.:zkteco_zkbiosecurity:*:*:*:*:*:*:*:*), a biometric security management system. The root cause is CWE-551 (Incorrect Behavior Order: Authorization Before Parsing and Canonicalization), where the authLoginAction!login.do script responds differently to partial username inputs, allowing attackers to enumerate valid accounts. This is a classic timing/response-based enumeration flaw in the authentication mechanism.
RemediationAI
No specific patch information is available in the provided references. Organizations should: 1) Contact ZKTeco for an updated version that addresses this vulnerability, 2) Implement rate limiting on the authentication endpoint, 3) Ensure consistent error messages regardless of username validity, 4) Monitor authentication logs for enumeration attempts. The vendor advisory link (https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction) should be consulted for official guidance.
Share
External POC / Exploit Code
Leaving vuln.today