CVE-2016-20025
Published: 16 March 2026
Summary
CVE-2016-20025 is a high-severity Files or Directories Accessible to External Parties (CWE-552) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Services File Permissions Weakness (T1574.010); ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).
Deeper analysis
CVE-2016-20025 is an insecure file permissions vulnerability (CWE-552) in ZKTeco ZKAccess Professional 3.5.3. The issue stems from the Authenticated Users group being granted Modify permissions on executable files, enabling authenticated users to replace legitimate binaries with malicious code to escalate privileges.
An attacker requires low privileges (PR:L) as an authenticated user and can exploit the vulnerability remotely (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), without changing scope (S:U). Successful exploitation grants high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H), with a CVSS v3.1 base score of 8.8, allowing full privilege escalation on the affected system.
Advisories and exploit details are documented in references such as CXSecurity (WLB-2016080265), IBM XForce Exchange (vulnerability 116486), PacketStormSecurity (file 138566), Exploit-DB (exploit 40323), and VulnCheck, which cover the privilege escalation via insecure permissions but do not specify patches in the provided CVE information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2016-10805
Vulnerability details
ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group to replace executable binaries with malicious code…
more
for privilege escalation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Insecure Modify permissions on executables (CWE-552) directly allow authenticated low-priv users to overwrite binaries with malicious code, enabling local privilege escalation via hijacked execution flow.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
CM-5 restricts access to modifications of configuration-controlled components like executable files to authorized personnel only, directly countering the Modify permissions granted to all authenticated users.
AC-6 enforces least privilege, ensuring authenticated users lack unnecessary Modify permissions on executable files that enable privilege escalation.
SC-34 implements mechanisms to protect executable programs from unauthorized modification, preventing replacement with malicious code for privilege escalation.