Read the docs
TI-2026-70835 Aliases CVE-2026-108798GHSA-9jjc-qwqp-v5mv

ZKTeco BioTime hard-coded cryptographic key

Priority LOW 36CWE-320Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-321.

Summary

Manipulation of an unspecified processing function in ZKTeco BioTime 9.5.6 Build 20260130.3206 results in use of a hard-coded cryptographic key (CWE-321). The attack can be launched remotely. CVSS 4.0 rates it 6.9, MEDIUM.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00278 20th percentileScored 2026-11-07
Fix Fixed BioTime (ZKTeco): 9.5.6 Build 3623

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZKTecoBioTime9.5.6 Build 20260130.32069.5.6 Build 3623Patch availableCNA
  • BioTime VendorZKTeco Affected 9.5.6 Build 20260130.3206 Fixed in 9.5.6 Build 3623 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*——ZKTeco
  • cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:* Versions — — ·ZKTeco

Remediation

Upgrade ZKTeco BioTime to 9.5.6 Build 3623, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA BioTime (ZKTeco) Fixed in 9.5.6 Build 3623

Timeline

  1. 2026-10-12 Threatist record created from CVE-2026-108798
  2. 2026-10-12 Alias added: GHSA-9jjc-qwqp-v5mv
  3. 2026-10-12 Priority changed: MEDIUM → LOW
  4. 2026-10-15 CISA SSVC decision points changed
  5. 2026-10-16 CVSS score changed · CNA
  6. 2026-10-16 Fix available: ZKTeco/[email protected] Build 3623 · CNA
  7. 2026-10-16 1 new reference · CNA

References

Patch 1

  • TI-2023-20210 A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows… KEVCVSS 3.1HIGH 7.5
  • TI-2025-28829 Hard-coded credentials in ZKTeco ZKBio CVSecurity CVSS 3.1CRITICAL 9.8
  • TI-2024-24297 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVSS 3.1CRITICAL 9.8
  • TI-2023-20211 ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated… CVSS 3.1CRITICAL 9.8
  • TI-2016-09202 ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution CVSS 4.0CRITICAL 9.3
  • TI-2016-09200 ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation CVSS 4.0CRITICAL 9.3
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences