CVE-2016-20031 PUBLISHED

ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests. Attackers can exploit the EnvironmentUtil.getClientIp() method which treats IPv6 loopback address 0:0:0:0:0:0:0:1 as 127.0.0.1 and authenticates using the IP as username with hardcoded password 123456 to access sensitive information and perform unauthorized actions.

• LiquidWorm as Gjoko Krstic of Zero Science Lab finder

• Zero Science Lab Disclosure
• CXSecurity
• IBM X-Force Exchange
• Packet Storm Security
• Reference
• VulnCheck Advisory: ZKTeco ZKBioSecurity 3.0 Local Authorization Bypass via visLogin.jsp

• Use of Hard-coded Credentials CWE