Executive brief
ZKTeco ZKBioSecurity is an integrated security platform used for access control, video surveillance, and visitor management. A vulnerability in the visitor login component allows a local user to bypass normal authentication and gain unauthorized access to the system. By exploiting this flaw, an attacker could view sensitive security information or perform unauthorized actions within the management interface.
Technical details
A local authorization bypass exists in ZKTeco ZKBioSecurity 3.0 within the 'visLogin.jsp' component. The vulnerability stems from the 'EnvironmentUtil.getClientIp()' method, which incorrectly handles the IPv6 loopback address (0:0:0:0:0:0:0:1) by treating it as the IPv4 localhost (127.0.0.1). The application then automatically attempts to authenticate using this IP address as the username with a hardcoded password of '123456'. An attacker with local access can exploit this logic to bypass standard authentication mechanisms and gain access to the web-based security platform. This issue affects version 3.0.1.0_R_230 and potentially earlier versions.
Affected products
- ZKTeco ZKBioSecurity 3.0 3.0.1.0_R_230 and earlier
Timeline
- 2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
- 2016-08-31: advisory: Exploit-DB entry published
- 2016-09-01: advisory: CXSecurity advisory published
- 2026-03-16: other: CVE-2016-20031 assigned/published in NVD
References
- https://cxsecurity.com/issue/WLB-2016090003
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116488
- https://packetstormsecurity.com/files/138571
- https://www.exploit-db.com/exploits/40327/
- https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-local-authorization-bypass-via-vislogin-jsp
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5367.php