ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files. Attackers can exploit world-writable permissions on the ZKTimeNet3.0 directory and its contents to replace executable files with malicious binaries for privilege escalation.
Weakness
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Potential Mitigations
Related Attack Patterns
References
- https://cxsecurity.com/issue/WLB-2016080264
- https://exchange.xforce.ibmcloud.com/vulnerabilities/116487
- https://packetstormsecurity.com/files/138565
- https://www.exploit-db.com/exploits/40322/
- https://www.vulncheck.com/advisories/zkteco-zktime-net-insecure-file-permissions-privilege-escalation
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5360.php