EUVD-2016-10803Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Sensitive file access control
|
| Impact | Despite the alarming CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the actual risk profile is more nuanced. The CVSS vector indicates network attack vector with no privileges required, but the vulnerability description clearly states it requires local access to exploit the world-writable directory permissions. This discrepancy suggests the CVSS score may be inflated. The vulnerability is not in CISA's KEV catalog, indicating no known active exploitation in the wild. However, the availability of multiple public exploits (Exploit-DB ID 40322, PacketStorm) and the trivial exploitation method (simply replacing executables) make this a moderate-to-high risk for organizations with multi-user systems or those lacking proper access controls. The ENISA EUVD listing (EUVD-2016-10803) confirms European recognition of this vulnerability. |
| Exploit ScenarioDerived | An attacker with unprivileged local access to a system running ZKTime.Net 3.0.1.6 can navigate to the installation directory (typically under Program Files). Due to world-writable permissions, they can replace legitimate executable files (like ZKTime.Net.exe) with malicious binaries. When an administrator or privileged user next launches the application, the malicious code executes with their elevated privileges. Public exploits demonstrate this attack, making it trivial for even unsophisticated attackers. The attack requires no special tools beyond basic file system access, making it highly automatable once initial access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 15, 2026
Critical insecure file permissions vulnerability in ZKTeco ZKTime.Net 3.0.1.6 that allows unprivileged local users to gain elevated privileges by replacing executable files in the world-writable application directory. Multiple public proof-of-concept exploits are available on Exploit-DB and PacketStorm, making this vulnerability easily exploitable despite requiring local access. While not listed in CISA KEV and lacking current EPSS data, the availability of working exploits and the simplicity of the attack make this a significant risk for organizations using this time and attendance software.
RemediationAI
No specific patch version is mentioned in the available references. Immediate mitigation involves manually correcting the file permissions on the ZKTimeNet3.0 directory to remove world-writable access (chmod 755 or more restrictive). Organizations should: 1) Audit and correct permissions on the installation directory and all contained files, 2) Implement the principle of least privilege for system access, 3) Monitor for unauthorized modifications to application executables, 4) Contact ZKTeco for an updated version that properly sets file permissions during installation. The ZeroScience advisory (https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5360.php) may contain additional mitigation details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability stems from CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory), where the ZKTime.Net 3.0.1.6 application installs with world-writable permissions on its program directory 'ZKTimeNet3.0' and all contained files. Based on the CPE string (cpe:2.3:a:zkteco_inc.:zkteco_zktime.net:*:*:*:*:*:*:*:*), all versions of ZKTeco's ZKTime.Net time and attendance management software appear affected. This insecure permission configuration allows any local user to modify, replace, or inject malicious executables into the application directory, which will then run with the privileges of users who execute the legitimate application.
Know when Zkteco Zktime Net gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files. Attackers can exploit world-writable permissions on the ZKTimeNet3.0 directory and its contents to replace executable files with malicious binaries for privilege escalation.
Executive ViewAI
ZKTeco ZKTime.Net 3.0.1.6 contains a critical privilege escalation vulnerability (CVSS 9.8) with active public exploits and no available patch. Any unprivileged user with local access can gain administrative control of the system, enabling complete compromise of time and attendance operations, data theft, and lateral network movement.
- Restrict local system access via physical controls and OS-level login restrictions to administrators only. 2) Change directory permissions: remove world-writable flags on ZKTimeNet3.0 folder and all subdirectories; set ownership to dedicated service account with minimal privileges. 3) Implement file integrity monitoring (FIM) on executable paths to detect unauthorized modifications in real-time. 4) Isolate ZKTime.Net systems on a segregated network segment with restricted access. 5) Deploy host-based intrusion detection to monitor privilege escalation attempts. 6) Disable unnecessary local user accounts and enforce strong authentication. 7) Monitor process execution for unsigned or suspicious binaries originating from the ZKTimeNet3.0 directory.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Exploit-DB
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC