CVE-2016-20025 PUBLISHED

ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.

• LiquidWorm as Gjoko Krstic of Zero Science Lab finder

• Zero Science Lab Disclosure
• CXSecurity
• IBM X-Force Exchange
• Packet Storm Security
• Reference
• VulnCheck Advisory: ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions

• Files or Directories Accessible to External Parties CWE