Junglewise Threat Intelligence

CVE-2016-20028: ZKTeco ZKBioSecurity CSRF in superadmin account creation

CVE-2016-20028 · Severity: medium · CVSS 4.3 · Published 2026-03-16

Technologies: Zkteco ZKBioSecurity. Vendors: Zkteco.

Executive brief

ZKTeco ZKBioSecurity is a web-based security platform used for access control, video surveillance, and visitor management. A security flaw allows an attacker to trick a logged-in administrator into unknowingly performing actions on the platform, such as creating new 'superadmin' accounts. This could lead to an unauthorized person gaining full control over the building's security systems, including door access and video feeds.

Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in ZKTeco ZKBioSecurity 3.0 (specifically tested on version 3.0.1.0_R_230). The application's web interface fails to implement sufficient validity checks (such as anti-CSRF tokens) on sensitive HTTP requests. An attacker can craft a malicious HTML page that, when visited by a logged-in administrator, silently submits a POST request to the '/authUserAction!edit.action' endpoint. This request can be configured to create a new user account with 'isSuperuser' set to true, effectively granting the attacker full administrative access to the security management platform. The vulnerability was originally discovered by Zero Science Lab (ZSL-2016-5364).

Affected products

  • ZKTeco ZKBioSecurity <= 3.0.1.0_R_230

Timeline

  • 2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
  • 2016-08-31: advisory: Public exploit and advisory released by Zero Science Lab and Exploit-DB
  • 2026-03-16: other: CVE-2016-20028 assigned/published in NVD

References

Related threats