Read the docs
TI-2026-70827 Aliases CVE-2026-108794GHSA-p2w8-wxvx-4fm5

SQL injection in ZKTeco BioTime Database Migration Functionality

Priority LOW 23CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

ZKTeco BioTime from 9.5.6 Build 20260130.3206 before 9.5.6 Build 3623 contains an SQL injection flaw (CWE-89) in its Database Migration Functionality. Input to the db_migrate_setting endpoint is not properly neutralized before it is used in an SQL command. A remote attacker with low privileges can manipulate this input to inject SQL.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00196 9th percentileScored 2026-11-07
Fix Fixed BioTime (ZKTeco): 9.5.6 Build 3623

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZKTecoBioTime9.5.6 Build 20260130.32069.5.6 Build 3623Patch availableCNA
  • BioTime VendorZKTeco Affected 9.5.6 Build 20260130.3206 Fixed in 9.5.6 Build 3623 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*——ZKTeco
  • cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:* Versions — — ·ZKTeco

Remediation

Upgrade ZKTeco BioTime to 9.5.6 Build 3623, the fixed version listed for the product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA BioTime (ZKTeco) Fixed in 9.5.6 Build 3623

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108794
  2. 2026-10-12 Alias added: GHSA-p2w8-wxvx-4fm5
  3. 2026-10-15 CISA SSVC decision points changed
  4. 2026-10-16 CVSS score changed · CNA
  5. 2026-10-16 Fix available: ZKTeco/[email protected] Build 3623 · CNA
  6. 2026-10-16 1 new reference · CNA

References

Patch 1

  • TI-2023-20210 A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows… KEVCVSS 3.1HIGH 7.5
  • TI-2025-28829 Hard-coded credentials in ZKTeco ZKBio CVSecurity CVSS 3.1CRITICAL 9.8
  • TI-2024-24297 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVSS 3.1CRITICAL 9.8
  • TI-2023-20211 ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated… CVSS 3.1CRITICAL 9.8
  • TI-2016-09202 ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2016-09200 ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation CVSS 4.0CRITICAL 9.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences