Is CVE-2016-20030 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-20030 being exploited in the wild.

How severe is CVE-2016-20030?

Critical severity, with a CVSS score of 9.8, published 16 March 2026.

Which products and versions are affected?

Zkteco ZKBioSecurity <= 3.0.1.0_R_230.

Is there a fix for CVE-2016-20030?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2016-20030 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2016-20030?

Check whether you run Zkteco ZKBioSecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20030: ZKTeco ZKBioSecurity user enumeration in authLoginAction

Q: Is there a fix for CVE-2016-20030?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2016-20030 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2016-20030?

Check whether you run Zkteco ZKBioSecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-20030 · Severity: critical · CVSS 9.8 · Published 2026-03-16

ZKTeco ZKBioSecurity, a security management platform used for access control and surveillance, contains a flaw that allows unauthorized individuals to identify valid system usernames. By submitting partial characters to the login page, an attacker can determine which accounts exist based on how the system responds. This information can be used to launch more targeted attacks, such as password guessing, potentially leading to unauthorized access to sensitive security systems and facility controls.

Technologies: Zkteco ZKBioSecurity. Vendors: Zkteco.

Quick answers

Is CVE-2016-20030 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-20030 being exploited in the wild.
How severe is CVE-2016-20030?: Critical severity, with a CVSS score of 9.8, published 16 March 2026.
Which products and versions are affected?: Zkteco ZKBioSecurity <= 3.0.1.0_R_230.
Is there a fix for CVE-2016-20030?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2016-20030 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2016-20030?: Check whether you run Zkteco ZKBioSecurity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A user enumeration vulnerability exists in ZKTeco ZKBioSecurity versions up to 3.0.1.0_R_230 due to improper handling of login requests in the authLoginAction!login.do script. The application's response logic allows an unauthenticated remote attacker to distinguish between valid and invalid usernames by submitting partial character strings to the username parameter. This behavior, classified as CWE-551 (Incorrect Behavior Order), enables an attacker to map out valid user accounts. While the CVSS score is high (9.8), the primary technical impact is the disclosure of account names, which facilitates subsequent brute-force or credential stuffing attacks. No official patch is explicitly detailed in the advisory, though the vulnerability was reported against version 3.0.

Affected products

ZKTeco ZKBioSecurity <= 3.0.1.0_R_230

Timeline

2016-09-22: disclosed: Initial discovery by Zero Science Lab (ZSL-2016-5366)
2026-03-16: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.