CVE-2026-108798: Use of Hard-coded Cryptographic Key in ZKTeco BioTime

This vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involves the use of a hard-coded cryptographic key in an unspecified processing component. The presence of a hard-coded key can weaken cryptographic security, potentially allowing remote attackers to bypass protections or decrypt sensitive data. The exact impact and exploitation details are not fully described. The vendor was contacted but did not respond, and no official patch or mitigation information is available.

The use of a hard-coded cryptographic key can undermine the confidentiality and integrity of cryptographic operations within the affected software. Remote attackers may exploit this to compromise secure communications or authentication mechanisms relying on the key. The CVSS 4.0 score of 6.9 (medium severity) reflects the potential for remote exploitation without user interaction or privileges, but with limited impact scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is provided, users should monitor official channels for updates. Until a fix is available, consider restricting network access to the affected system to trusted sources to reduce exposure.