Read the docs
TI-2026-70833 Aliases CVE-2026-108796GHSA-p9r4-cx92-c3hf

Authorization bypass in ZKTeco BioTime biometric data endpoint

Priority MEDIUM 57CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

ZKTeco BioTime from 9.5.6 Build 20260130.3206 has an authorization flaw in the Biometric Data Endpoint at /iclock/finger_data/. Manipulating the emp_code argument lets a user bypass authorization through a user-controlled key (CWE-639). A remote attacker with low privileges can exploit it with low complexity. CISA's SSVC assessment reports proof-of-concept exploitation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed BioTime (ZKTeco): 9.5.6 Build 3623

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZKTecoBioTime9.5.6 Build 20260130.32069.5.6 Build 3623Patch availableCNA
  • BioTime VendorZKTeco Affected 9.5.6 Build 20260130.3206 Fixed in 9.5.6 Build 3623 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*——ZKTeco
  • cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:* Versions — — ·ZKTeco

Remediation

Upgrade ZKTeco BioTime to 9.5.6 Build 3623, which fixes the Biometric Data Endpoint.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA BioTime (ZKTeco) Fixed in 9.5.6 Build 3623

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108796
  2. 2026-10-12 Alias added: GHSA-p9r4-cx92-c3hf
  3. 2026-10-16 CVSS score changed · CNA
  4. 2026-10-16 Fix available: ZKTeco/[email protected] Build 3623 · CNA
  5. 2026-10-16 1 new reference · CNA
  6. 2026-10-16 CISA SSVC decision points changed
  7. 2026-10-16 Priority changed: LOW → MEDIUM

References

Patch 1

  • TI-2023-20210 A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows… KEVCVSS 3.1HIGH 7.5
  • TI-2025-28829 Hard-coded credentials in ZKTeco ZKBio CVSecurity CVSS 3.1CRITICAL 9.8
  • TI-2024-24297 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVSS 3.1CRITICAL 9.8
  • TI-2023-20211 ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated… CVSS 3.1CRITICAL 9.8
  • TI-2016-09202 ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2016-09200 ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation CVSS 4.0CRITICAL 9.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences