Junglewise Threat Intelligence

CVE-2016-20032: ZKTeco ZKAccess Security System stored XSS in AccHolidays

CVE-2016-20032 · Severity: high · CVSS 7.2 · Published 2026-03-16

Vendors: Zkteco.

Executive brief

ZKTeco ZKAccess is a web-based security management system used to monitor and control physical access points like doors and turnstiles. A security flaw allows attackers to inject malicious scripts into the system's database through holiday and memo fields. If an administrator views these records, the script could execute in their browser, potentially allowing the attacker to hijack their session, steal sensitive credentials, or tamper with security settings.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in ZKTeco ZKAccess Security System version 5.3.1 (tested on build 5.3.12252). The vulnerability is rooted in the lack of proper sanitization of input passed to the 'holiday_name' and 'memo' POST parameters within the AccHolidays component. An attacker can submit a crafted POST request to the /data/iaccess/AccHolidays/_new_/ endpoint containing malicious JavaScript payloads. Because the input is stored and later rendered without encoding, the script executes in the context of any user (typically an administrator) who views the holiday management page. This can lead to session hijacking, unauthorized administrative actions, or information disclosure. The system was observed running on a CherryPy WSGI server with Python 2.6.

Affected products

  • ZKTeco ZKAccess Security System 5.3.1 (specifically 5.3.12252) and earlier

Timeline

  • 2016-07-18: disclosed: Vulnerability discovered by Zero Science Lab
  • 2016-08-31: advisory: Exploit-DB entry published
  • 2016-09-01: advisory: CXSecurity advisory published
  • 2026-03-16: other: CVE-2016-20032 assigned/published in NVD

References