ZKTeco ZKAccess Professional 3.5.3 Insecure File Permissions
Posted by deepcore on September 1, 2016 – 12:55 pm
ZKAccess suffers from an elevation of privileges vulnerability which can be used by a simple authenticated user that can change the executable file with a binary of choice. The vulnerability exist due to the improper permissions, with the ‘M’ flag (Modify) for ‘Authenticated Users’ group. Version 3.5.3 is affected.
Post a reply
You must be logged in to post a comment.