How severe is CVE-2016-20030?

CVE-2016-20030 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2016-20030 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2016-20030?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2016-20030 have an EU (EUVD) identifier?

Yes. CVE-2016-20030 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2016-10815.

When was CVE-2016-20030 published?

CVE-2016-20030 was published on 2026-03-16 and last updated on 2026-06-17.

CVE-2016-20030

CVE-2016-20030 is a critical-severity vulnerability with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-551.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 9.3
EPSS exploit prediction: 1% (43rd percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2016-10815
Weakness: CWE-551
Published: 2026-03-16
Last modified: 2026-06-17

Description

ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.

Frequently asked questions

What is CVE-2016-20030?: ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do script with varying username inputs to enumerate valid user accounts based on application responses.
How severe is CVE-2016-20030?: CVE-2016-20030 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2016-20030 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (43rd percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2016-20030?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2016-20030 have an EU (EUVD) identifier?: Yes. CVE-2016-20030 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2016-10815.
When was CVE-2016-20030 published?: CVE-2016-20030 was published on 2026-03-16 and last updated on 2026-06-17.

References

Other CWE-551 vulnerabilities

CVE-2026-4636 — High (CVSS 8.1): A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA)…
CVE-2026-57920 — High (CVSS 7.7): Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for…
CVE-2026-0707 — Medium (CVSS 5.3): A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of…

Browse all CWE-551 vulnerabilities →