CVE-2016-20029— ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2016-20029
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources. Attackers can manipulate path parameters to bypass access controls and retrieve sensitive information including configuration files, source code, and protected application resources.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
缺省权限不正确
Source: NVD (National Vulnerability Database)
Vulnerability Title
ZKTeco ZKBioSecurity 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
ZKTeco ZKBioSecurity是中国ZKTeco公司的一个基于 Web 的一体式平台。 ZKTeco ZKBioSecurity 3.0版本存在安全漏洞，该漏洞源于文件路径操作不当，可能导致攻击者通过修改文件路径访问任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| ZKTeco Inc. | ZKTeco ZKBioSecurity | 3.0.1.0_R_230 | - |
II. Public POCs for CVE-2016-20029
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-20029
Please Login to view more intelligence information
- ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerability - CXSecurity.comthird-party-advisory
- Packet Stormexploit
- Zero Science Lab » ZKTeco ZKBioSecurity 3.0 File Path Manipulation Vulnerabilitythird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2016-20029
Same Patch Batch · ZKTeco Inc. · 2026-03-15 · 9 CVEs total
| CVE-2016-20026 | 9.8 CRITICAL | ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution |
| CVE-2016-20030 | 9.8 CRITICAL | ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction |
| CVE-2016-20024 | 9.8 CRITICAL | ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation |
| CVE-2016-20025 | 8.8 HIGH | ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions |
| CVE-2016-20032 | 7.2 HIGH | ZKTeco ZKAccess Security System 5.3.1 Stored XSS |
| CVE-2016-20027 | 6.1 MEDIUM | ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilities |
| CVE-2016-20031 | 5.5 MEDIUM | ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp |
| CVE-2016-20028 | 4.3 MEDIUM | ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadmin |
IV. Related Vulnerabilities
Same product: ZKTeco ZKBioSecurity
- CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visL - CVE-2016-20030
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActio - CVE-2016-20028
ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadm - CVE-2016-20027
ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilit - CVE-2016-20026
ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code E
Same vendor: ZKTeco Inc.
- CVE-2016-20032
ZKTeco ZKAccess Security System 5.3.1 Stored XSS - CVE-2016-20031
ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visL - CVE-2016-20030
ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginActio - CVE-2016-20028
ZKTeco ZKBioSecurity 3.0 Cross-Site Request Forgery Superadm - CVE-2016-20027
ZKTeco ZKBioSecurity 3.0 Multiple Reflected XSS Vulnerabilit
Same weakness: CWE-276
- CVE-2026-0539
Local Privilege Escalation in pcvisit service client - CVE-2026-6823
HKUDS OpenHarness Insecure Default Remote Channel Allowlist - CVE-2026-6819
HKUDS OpenHarness Plugin Management Command Exposure - CVE-2026-39454
SKYSEA Client View 安全漏洞 - CVE-2026-30811
Missing Authorization in Configuration Ajax Endpoint leads t
V. Comments for CVE-2016-20029
No comments yet