ZKTeco ZKAccess Professional version 3.5.3 has an insecure file permissions flaw that allows any user who is authenticated to modify executable binaries. By replacing legitimate executables with malicious code, an attacker can gain elevated privileges or fully control the system. The weakness is a case of improper authorization and file permission control.

The vulnerability affects the ZKTeco ZKAccess Professional application from ZKTeco Inc., specifically version 3.5.3. There is no other version information provided, so all installations running this exact version are at risk.

The CVSS score of 8.7 indicates a high severity issue. The EPSS score is under 1%, suggesting a low overall exploitation probability, yet the vulnerability is still significant. It is not listed in the CISA KEV catalog, meaning there is no known widespread exploitation publicly disclosed. The attack requires an authenticated user; based on the description, the likely vector is local access or an attacker who can log into the system. If the authenticated user space is reachable remotely, then remote exploitation is possible. The impact is silent escalation, which could allow attackers to execute arbitrary code or impersonate administrators.