CVE-2026-108794

A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 affects unknown code in the file /personnel/api/employees/ of the Employee REST API component. The manipulation leads to authorization bypass. The attack can be initiated remotely.

A flaw in ZKTeco BioTime 9.5.6 Build 20260130.3206 affects an unknown part of the file /iclock/finger_data/ of the Biometric Data Endpoint component. Manipulating the emp_code argument leads to authorization bypass. The attack can be launched remotely.

A vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 affects unknown functionality of the file /base/api/systemSettings of the System Settings API component. The manipulation results in improper access controls. The attack can be initiated remotely.

A vulnerability was detected in ZKTeco BioTime up to versions 9.0.3/9.0.4/9.5.2, affecting an unknown part of the file /base/safe_setting/ of the Endpoint component. Manipulating the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials.

An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. The vulnerability stems from improper access control to data.

An insecure access control vulnerability in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate privileges because session IDs are not validated against user type. Any authenticated user can access administrative functions without restriction by making direct requests to admin endpoints.

A vulnerability in a hidden API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.