Cross-Site Request Forgery in ZKTeco ZKBioSecurity 3.0
CVE-2016-20028

5.3MEDIUM

Key Information:

Vendor

Zkteco Inc.

Status
Zkteco ZkbiOSecurity
Vendor
CVE Published:
15 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20028?

ZKTeco ZKBioSecurity 3.0 is susceptible to a cross-site request forgery (CSRF) vulnerability, allowing attackers to execute unauthorized administrative actions. By manipulating authenticated users into visiting specially crafted malicious websites, attackers can send HTTP requests that add superadmin accounts without any validation checks. This breach can lead to severe security implications, enabling unauthorized access to critical administrative functions.

Affected Version(s)

ZKTeco ZKBioSecurity 3.0.1.0_R_230

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20028 - Proof of Concept

CVE-2016-20028 - Proof of Concept

References

https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-53...
third-party-advisory
https://cxsecurity.com/issue/WLB-2016080268
third-party-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/116477
vdb-entry

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

LiquidWorm as Gjoko Krstic of Zero Science Lab
.