Zkteco Zkbiosecurity CVE-2016-20031

While the CVSS 3.1 score of 5.5 is moderate, multiple risk signals indicate higher practical concern: (1) Attack Vector is Local (AV:L) and Access Complexity is Low (AC:L), meaning any local user can exploit this without privilege escalation; (2) Confidentiality Impact is High (C:H), allowing unauthorized access to sensitive biometric or security data managed by ZKBioSecurity; (3) Public exploits are available on Packet Storm Security and Exploit-DB, reducing exploitation barriers significantly; (4) The vulnerability was reported by credible security researcher(s) through ZeroScience and VulnCheck, suggesting thorough analysis; (5) No patch availability data is present in references, suggesting end-of-life or unpatched status for version 3.0. The low CVSS score underrepresents risk due to AV:L constraint—in environments where local access is achievable (contractor workstations, supply-chain compromise, insider threat), this becomes a high-confidence privilege escalation or lateral movement path. SSVC perspective: Exploitation is likely (public POC), automatable (simple IP/password combo), and technical impact is high (access to credential storage, biometric data, system configuration). Real priority: HIGH for organizations actively running ZKBioSecurity 3.0.

An attacker with local user access on a network where ZKBioSecurity 3.0 is deployed (e.g., contractor on corporate LAN, compromised workstation in same subnet, or VM co-tenancy scenario) crafts a web request to visLogin.jsp with IPv6 loopback address 0:0:0:0:0:0:0:1 as the client IP. The EnvironmentUtil.getClientIp() method fails to properly normalize this IPv6 format and treats it as a valid localhost connection. The attacker authenticates using the IPv6 address (or loopback variant) as username and password '123456'. The application grants access to the login portal, allowing the attacker to enumerate or modify users, extract biometric templates, modify access control policies, or access audit logs. Public POC code exists (Exploit-DB #40327, Packet Storm #138571) making this a paste-and-run exploit requiring minimal technical skill. In a supply-chain context, an attacker with brief physical or network access could pre-stage exploitation by installing a rogue service that repeatedly attempts this bypass, maintaining persistent access even after physical removal.