critical9.8
CVE-2016-20024
ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fil…
Impact
ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files. Attackers can exploit world-writable permissions on the ZKTimeNet3.0 directory and its contents to replace executable files with malicious binaries for privilege escalation.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.
Weakness classification
References
- NVD record
- CVE.org record
- https://cxsecurity.com/issue/WLB-2016080264
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116487
- https://packetstormsecurity.com/files/138565
- https://www.exploit-db.com/exploits/40322/
- https://www.vulncheck.com/advisories/zkteco-zktime-net-insecure-file-permissions-privilege-escalation
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5360.php