CVE-2016-20031
Local Auth Bypass in ZKTeco ZKBioSecurity via IPv6 Spoofing
Publication date: 2026-03-16
Last updated on: 2026-03-16
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zkteco | zkbiosecurity | to 3.0.1.0_R_230 (exc) |
| zkteco | zkbiosecurity | 3.0 |
| zkteco | personnel | 1.0.1.0_r_1916 |
| zkteco | access | 6.0.1.0_r_1757 |
| zkteco | elevator | 2.0.1.0_r_777 |
| zkteco | visitor | 2.0.1.0_r_877 |
| zkteco | video | 2.0.1.0_r_489 |
| zkteco | adms | 1.0.1.0_r_197 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-798 | The product contains hard-coded credentials, such as a password or cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': 'CVE-2016-20031 is a local authorization bypass vulnerability in ZKTeco ZKBioSecurity 3.0, specifically in the visLogin.jsp script.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because the method EnvironmentUtil.getClientIp() treats the IPv6 loopback address (::1 or 0:0:0:0:0:0:0:1) as the IPv4 localhost address 127.0.0.1.'}, {'type': 'paragraph', 'content': 'This causes the system to use the IP address as the username and a hardcoded password "123456" to authenticate automatically, allowing attackers who can spoof or originate requests from the local machine to bypass normal authentication controls.'}, {'type': 'paragraph', 'content': 'As a result, attackers can gain unauthorized access to sensitive information and perform unauthorized actions within the ZKBioSecurity platform.'}] [1, 2, 3, 4]
How can this vulnerability impact me? :
This vulnerability allows an attacker with local access or the ability to spoof local requests to bypass authentication without valid credentials.
Exploiting this flaw can lead to unauthorized access to sensitive information stored or managed by the ZKBioSecurity platform.
Additionally, attackers can perform unauthorized actions within the system, potentially compromising the security and integrity of access control, video linkage, elevator control, visitor management, and other integrated modules.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking for unauthorized login attempts that use the IP address 127.0.0.1 (or the IPv6 loopback address ::1) as the username combined with the hardcoded password "123456". Monitoring web server logs for requests to visLogin.jsp originating from localhost or spoofed localhost IP addresses is a key detection method.'}, {'type': 'paragraph', 'content': 'Since the vulnerability exploits the EnvironmentUtil.getClientIp() method treating IPv6 loopback as IPv4 localhost, you can look for HTTP requests to visLogin.jsp with the username field set to 127.0.0.1 or ::1 and password set to "123456".'}, {'type': 'list_item', 'content': 'Check web server access logs for POST requests to visLogin.jsp with username=127.0.0.1 and password=123456.'}, {'type': 'list_item', 'content': "Use commands like `grep 'visLogin.jsp' /path/to/access.log | grep '127.0.0.1'` to filter suspicious login attempts."}, {'type': 'list_item', 'content': 'Monitor for any automated login attempts or JavaScript form submissions that set username to 127.0.0.1 and password to 123456.'}] [1, 2, 4]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'Immediate mitigation steps include restricting local access to the ZKBioSecurity platform to trusted users only, as the vulnerability requires local or spoofed localhost access.'}, {'type': 'paragraph', 'content': 'Disable or restrict access to the visLogin.jsp page from untrusted sources and ensure that requests claiming to originate from localhost IP addresses are properly validated.'}, {'type': 'paragraph', 'content': 'Change or remove the hardcoded password "123456" used for authentication with the localhost IP username to prevent unauthorized access.'}, {'type': 'paragraph', 'content': 'Apply any available patches or updates from ZKTeco that address this authorization bypass vulnerability.'}, {'type': 'paragraph', 'content': 'Monitor logs for suspicious login attempts and consider implementing network-level controls to prevent IP spoofing of localhost addresses.'}] [1, 2, 4]