Is CVE-2016-20025 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-20025 being exploited in the wild.

How severe is CVE-2016-20025?

High severity, with a CVSS score of 8.8, published 16 March 2026.

Which products and versions are affected?

Zkteco ZKAccess Professional 3.5.3 (Build 0005) and earlier.

Is there a fix for CVE-2016-20025?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-20025 attacked?

It is attacked over the network or with local access, in a network appliance.

Am I affected by CVE-2016-20025?

Check whether you run Zkteco ZKAccess Professional at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20025: ZKTeco ZKAccess Professional privilege escalation via insecure file permissions

CVE-2016-20025 · Severity: high · CVSS 8.8 · Published 2026-03-16

ZKTeco ZKAccess Professional is a desktop software suite used to manage physical access control readers and employee attendance reports. A security flaw in the software's installation allows any standard user on the system to modify or replace the application's executable files. An attacker could use this to plant malicious code that runs with higher system privileges, potentially leading to a full takeover of the computer managing the building's security infrastructure.

Vendors: Zkteco.

Quick answers

Is CVE-2016-20025 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-20025 being exploited in the wild.
How severe is CVE-2016-20025?: High severity, with a CVSS score of 8.8, published 16 March 2026.
Which products and versions are affected?: Zkteco ZKAccess Professional 3.5.3 (Build 0005) and earlier.
Is there a fix for CVE-2016-20025?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-20025 attacked?: It is attacked over the network or with local access, in a network appliance.
Am I affected by CVE-2016-20025?: Check whether you run Zkteco ZKAccess Professional at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

ZKTeco ZKAccess Professional 3.5.3 (Build 0005) suffers from an insecure file permission configuration (CWE-552) where the 'Modify' (M) flag is granted to the 'Authenticated Users' group for the application directory. This allows a low-privileged local or network-authenticated user to replace legitimate service binaries or executables with malicious code. Upon execution by a higher-privileged user or the system, the attacker's code runs with elevated privileges, leading to full system compromise. The vulnerability was verified on Windows 7 environments using the icacls utility to confirm improper inheritance and permission assignments.

Affected products

ZKTeco ZKAccess Professional 3.5.3 (Build 0005) and earlier

Timeline

2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
2016-08-31: advisory: Public advisory and exploit released by Zero Science Lab (ZSL-2016-5361)
2026-03-16: other: CVE-2016-20025 assigned/published via VulnCheck

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.