CVE-2016-20025: ZKTeco Inc ZKTeco Zkaccess Professional

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code for privilege escalation.

Affected products

• ZKTeco Inc ZKTeco Zkaccess Professional: version 3.5.3 (Build 0005) only

Published 2026-03-16. Last modified 2026-06-17.