Cyber Resilience

CVE-2016-20032

MediumPublic PoCUpdated

Published: 16 March 2026

Published
16 March 2026
Modified
08 June 2026
KEV Added
Patch
CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 4.1th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2016-20032 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Cxsecurity (inferred from references). Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 4.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2016-20032 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting ZKTeco ZKAccess Security System version 5.3.1. The flaw enables attackers to inject and store malicious HTML and JavaScript payloads via the 'holiday_name' and 'memo' POST parameters, which are then executed in the browsers of users accessing the affected system.

Unauthenticated attackers (PR:N) with network access (AV:N) can exploit this vulnerability by submitting crafted HTTP requests containing script code in the specified parameters. Exploitation requires low complexity (AC:L) and no user interaction (UI:N), resulting in a scope change (S:C) that allows limited compromise of confidentiality (C:L) and integrity (I:L) with no availability impact (A:N). This yields a CVSS v3.1 base score of 7.2 (High), enabling attackers to hijack user browser sessions and steal sensitive information.

Reference advisories and exploit details are documented in sources including cxsecurity.com (WLB-2016090004), IBM X-Force Exchange (vulnerability 116479), Packet Storm Security (file 138572), Exploit-DB (exploit 40328), and VulnCheck advisory on the ZKTeco ZKAccess stored XSS issue. These publications do not specify patches or mitigations in the provided information.

EU & UK References

Vulnerability details

ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can submit crafted requests with script code…

more

in these parameters to compromise user browser sessions and steal sensitive information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Why these techniques?

Stored XSS directly enables arbitrary JavaScript execution in victim browsers (T1059.007) and facilitates browser session hijacking with info theft (T1185).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-27279Shared CWE-79
CVE-2025-24541Shared CWE-79
CVE-2024-56036Shared CWE-79
CVE-2025-1401Shared CWE-79
CVE-2025-24416Shared CWE-79
CVE-2026-34566Shared CWE-79
CVE-2026-24744Shared CWE-79
CVE-2025-40899Shared CWE-79
CVE-2025-22598Shared CWE-79
CVE-2025-23531Shared CWE-79

Affected Assets

Cxsecurity
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation and sanitization of inputs such as holiday_name and memo to block script injection before storage and later execution.

prevent

Requires filtering of information outputs so that stored malicious payloads cannot be rendered and executed in user browsers.

preventdetect

Provides mechanisms to detect and block malicious code (including script payloads) at ingress or before delivery to client browsers.

References