CVE-2016-20028

CVE-2016-20028 is a Cross-Site Request Forgery (CSRF) vulnerability affecting ZKTeco ZKBioSecurity 3.0. This flaw allows an attacker to trick a logged-in administrator into visiting a malicious website, enabling the attacker to perform administrative actions. Specifically, it permits the addition of superadmin accounts without proper validity checks, leading to unauthorized administrative access. Rated Medium with a CVSS v3.1 score of 4.3, the vulnerability has low attack complexity over the network and can result in low integrity impact. There is currently no evidence of active exploitation, public exploit code, or significant community attention regarding this CVE.