CVE-2016-20030 describes a critical user enumeration vulnerability (CVSS 9.8) in ZKTeco ZKBioSecurity 3.0, allowing unauthenticated attackers to remotely discover valid usernames by submitting partial characters to the login script. This vulnerability has a network-based attack vector and low complexity, enabling high confidentiality, integrity, and availability impacts. While not on the CISA KEV catalog and lacking public exploit modules, community discussions indicate the existence of exploit code, though some posts incorrectly claim remote code execution for this user enumeration flaw.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| ZKTeco Inc. | ZKTeco ZKBioSecurity | 3.0.1.0_R_230CNA affected |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.