Junglewise Threat Intelligence

CVE-2016-20024: ZKTeco ZKTime.Net privilege escalation via insecure file permissions

CVE-2016-20024 · Severity: critical · CVSS 9.8 · Published 2026-03-16

Vendors: Zkteco.

Executive brief

ZKTeco ZKTime.Net, a software suite used for managing employee time attendance and access control systems, contains a security flaw in how it handles file permissions. This allows any user with basic access to the computer to replace the software's legitimate files with malicious ones. An attacker could use this to gain full administrative control over the system, potentially compromising employee data or disrupting physical access control operations.

Technical details

ZKTeco ZKTime.Net (versions 3.0.1.1 through 3.0.1.6) suffers from an elevation of privilege vulnerability due to improper Access Control List (ACL) configurations. The application's installation directory (ZKTimeNet3.0) and its contained executables are configured with 'Change' permissions for the 'Everyone' group (world-writable). A local, unprivileged attacker can exploit this by replacing legitimate binaries, such as ZKTimeNet.exe, with a malicious payload. When a higher-privileged user or the system executes the modified binary, the attacker's code runs with elevated privileges. While some CVSS strings suggest a network vector, the root cause is a local filesystem permission issue on Windows-based installations.

Affected products

  • ZKTeco ZKTime.Net 3.0.1.6, 3.0.1.5 (160622), 3.0.1.1 (160216)

Timeline

  • 2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
  • 2016-08-31: advisory: Public advisory and exploit released by Zero Science Lab (ZSL-2016-5360)
  • 2026-03-16: advisory: CVE-2016-20024 published/updated in NVD

References