CVE-2016-20030

9.3 criticalEPSS 0.6%

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.

Severity

CVSS 4.0

9.3 critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
CWE: CWE-551
Published: 2026-03-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/116485
https://packetstormsecurity.com/files/138573
https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5366.php

Check your stack JSON