{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2016-20030",
        "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "state": "PUBLISHED",
        "assignerShortName": "VulnCheck",
        "dateReserved": "2026-03-15T12:37:09.340Z",
        "datePublished": "2026-03-15T13:35:32.348Z",
        "dateUpdated": "2026-06-08T15:11:53.975Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
                "shortName": "VulnCheck",
                "dateUpdated": "2026-06-08T15:11:53.975Z"
            },
            "datePublic": "2016-08-31T00:00:00.000Z",
            "title": "ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction",
            "descriptions": [
                {
                    "lang": "en",
                    "value": "ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses."
                }
            ],
            "problemTypes": [
                {
                    "descriptions": [
                        {
                            "lang": "en",
                            "description": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
                            "cweId": "CWE-551",
                            "type": "CWE"
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "vendor": "ZKTeco Inc.",
                    "product": "ZKTeco ZKBioSecurity",
                    "versions": [
                        {
                            "version": "3.0.1.0_R_230",
                            "status": "affected"
                        }
                    ]
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "NONE",
                        "attackVector": "NETWORK",
                        "baseScore": 9.3,
                        "baseSeverity": "CRITICAL",
                        "privilegesRequired": "NONE",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "NONE",
                        "subConfidentialityImpact": "NONE",
                        "subIntegrityImpact": "NONE",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "HIGH",
                        "vulnIntegrityImpact": "HIGH",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS"
                },
                {
                    "cvssV3_1": {
                        "attackComplexity": "LOW",
                        "attackVector": "NETWORK",
                        "availabilityImpact": "HIGH",
                        "baseScore": 9.8,
                        "baseSeverity": "CRITICAL",
                        "confidentialityImpact": "HIGH",
                        "integrityImpact": "HIGH",
                        "privilegesRequired": "NONE",
                        "scope": "UNCHANGED",
                        "userInteraction": "NONE",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                        "version": "3.1"
                    },
                    "format": "CVSS"
                }
            ],
            "references": [
                {
                    "url": "https://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5366.php",
                    "name": "Zero Science Lab Disclosure",
                    "tags": [
                        "third-party-advisory"
                    ]
                },
                {
                    "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/116485",
                    "name": "IBM X-Force Exchange",
                    "tags": [
                        "vdb-entry"
                    ]
                },
                {
                    "url": "https://packetstormsecurity.com/files/138573",
                    "name": "Packet Storm Security",
                    "tags": [
                        "exploit"
                    ]
                },
                {
                    "name": "VulnCheck Advisory: ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction",
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://www.vulncheck.com/advisories/zkteco-zkbiosecurity-user-enumeration-via-authloginaction"
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "value": "LiquidWorm as Gjoko Krstic of Zero Science Lab",
                    "type": "finder"
                }
            ],
            "x_generator": {
                "engine": "vulncheck"
            },
            "solutions": [
                {
                    "lang": "en",
                    "value": "The affected software ZKBioSecurity and ZKAccess have been officially discontinued. It is recommended that users switch to using ZKBio CVSecurity software. ZKBio CVSecurity has fixed these vulnerabilities. It is recommended that customers use the latest version of ZKBio CVSecurity to eliminate risks."
                }
            ],
            "tags": [
                "unsupported-when-assigned"
            ]
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2016-20030",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "poc"
                                    },
                                    {
                                        "Automatable": "yes"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2026-03-16T14:14:00.622167Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2026-03-16T14:20:20.095Z"
                }
            }
        ]
    }
}