CVE-2016-20028— ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2016-20028
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin
Source: NVD (National Vulnerability Database)
Vulnerability Description
ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access when authenticated users visit attacker-controlled pages.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨站请求伪造(CSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
ZKTeco ZKBioSecurity 跨站请求伪造漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZKTeco ZKBioSecurity是中国ZKTeco公司的一个基于 Web 的一体式平台。 ZKTeco ZKBioSecurity 3.0版本存在跨站请求伪造漏洞，该漏洞源于跨站请求伪造，可能导致攻击者通过诱骗登录用户访问恶意网站执行管理操作。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ZKTeco Inc. | ZKTeco ZKBioSecurity | 3.0.1.0_R_230 | - |
II. Public POCs for CVE-2016-20028
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-20028
请登录查看更多情报信息。
- ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploit - CXSecurity.comthird-party-advisory
- IBM X-Force Exchangevdb-entry
- Packet Stormexploit
- Zero Science Lab » ZKTeco ZKBioSecurity 3.0 CSRF Add Superadmin Exploitthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-20028
Same Patch Batch · ZKTeco Inc. · 2026-03-15 · 9 CVEs total
| CVE-2016-20026 | 9.8 CRITICAL | ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution |
| CVE-2016-20030 | 9.8 CRITICAL | ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction |
| CVE-2016-20024 | 9.8 CRITICAL | ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation |
| CVE-2016-20025 | 8.8 HIGH | ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions |
| CVE-2016-20032 | 7.2 HIGH | ZKTeco ZKAccess Security System 5.3.1 Stored XSS |
| CVE-2016-20029 | 6.2 MEDIUM | ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability |
| CVE-2016-20027 | 6.1 MEDIUM | ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities |
| CVE-2016-20031 | 5.5 MEDIUM | ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp |
IV. Related Vulnerabilities
Same product: ZKTeco ZKBioSecurity
- CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visL - CVE-2016-20030
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActio - CVE-2016-20029
ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerabilit - CVE-2016-20027
ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilit - CVE-2016-20026
ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code E
Same vendor: ZKTeco Inc.
- CVE-2016-20032
ZKTeco ZKAccess Security System 5.3.1 Stored XSS - CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visL - CVE-2016-20030
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActio - CVE-2016-20029
ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerabilit - CVE-2016-20027
ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilit
Same weakness: CWE-352
- CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/pass - CVE-2021-47946
OpenCart 3.0.36 Account Takeover via Cross Site Request Forg - CVE-2022-50955
WordPress Plugin Curtain 1.0.2 Cross-site Request Forgery - CVE-2026-8194
osTicket Dispatcher class.dispatcher.php cross-site request - CVE-2026-42286
Emlog: Cross-Site Request Forgery in Admin Functions
V. Comments for CVE-2016-20028
No comments yet