Executive brief
ZKTeco ZKBioSecurity, a security management platform used for access control and surveillance, contains a flaw that allows unauthorized individuals to identify valid system usernames. By submitting partial characters to the login page, an attacker can determine which accounts exist based on how the system responds. This information can be used to launch more targeted attacks, such as password guessing, potentially leading to unauthorized access to sensitive security systems and facility controls.
Technical details
A user enumeration vulnerability exists in ZKTeco ZKBioSecurity versions up to 3.0.1.0_R_230 due to improper handling of login requests in the authLoginAction!login.do script. The application's response logic allows an unauthenticated remote attacker to distinguish between valid and invalid usernames by submitting partial character strings to the username parameter. This behavior, classified as CWE-551 (Incorrect Behavior Order), enables an attacker to map out valid user accounts. While the CVSS score is high (9.8), the primary technical impact is the disclosure of account names, which facilitates subsequent brute-force or credential stuffing attacks. No official patch is explicitly detailed in the advisory, though the vulnerability was reported against version 3.0.
Affected products
- ZKTeco ZKBioSecurity <= 3.0.1.0_R_230
Timeline
- 2016-09-22: disclosed: Initial discovery by Zero Science Lab (ZSL-2016-5366)
- 2026-03-16: advisory: NVD publication date