Threat database

CVE-2026-108798 is a vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key. This flaw allows remote attackers to exploit the cryptographic weakness. The issue is addressed by upgrading to version 9.5.6 Build 3623.

CVE-2026-108797 is an authorization bypass vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206 affecting the Employee REST API endpoint /personnel/api/employees/. This flaw allows remote attackers with low privileges to bypass authorization controls. The issue is resolved by upgrading to version 9.5.6 Build 3623.

CVE-2026-108796 is an authorization bypass vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206 affecting the Biometric Data Endpoint component. The flaw involves manipulation of the emp_code argument in the /iclock/finger_data/ file, allowing remote attackers to bypass authorization controls. The issue is mitigated by upgrading to version 9.5.6 Build 3623.

CVE-2026-108795 is a medium severity vulnerability in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving improper access controls in the System Settings API endpoint /base/api/systemSettings. The flaw allows remote attackers to manipulate the system due to insufficient access restrictions. Upgrading to version 9.5.6 Build 3623 resolves the issue.

CVE-2026-108794 is a medium severity SQL injection vulnerability in ZKTeco BioTime version 9.5.6 Build 20260130.3206. The flaw exists in an unspecified functionality of the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint related to database migration. This vulnerability allows remote attackers to perform SQL injection attacks. The issue is resolved by upgrading to version 9.5.6 Build 3623.

An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_setting/ of the component Endpoint. Performing a manipulation of the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 9.0.6 is able to mitigate this issue. It is recommended to upgrade the affected component. The vendor confirms: "The mainstream version ZKBioTime V9.0.6 has fixed this vulnerability. Please update to the latest version as soon as possible. For the Middle East version BioTime 9.5.X, you can contact the local technical support to obtain the fix package."

This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the plaintext sensitive data stored in the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized network access, retrieve and manipulate data on the targeted device.

EPSS 0.1%VulnerabilityZKTeco Co#cwe-312Germany+9

This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve private key stored in the firmware of the targeted device. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device.

EPSS 0.2%VulnerabilityZKTeco Co#cwe-798Germany+9

This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve the hard-coded MQTT credentials and endpoints from the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the MQTT broker and manipulate the communications of the targeted device.

EPSS 0.2%VulnerabilityZKTeco Co#cwe-798Germany+9

This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.

EPSS <0.1%VulnerabilityZKTeco Co#cwe-312Germany+9

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").

EPSS 0.4%VulnerabilityZKTeco#cwe-1393Germany+9

ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

A vulnerability was found in ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbio_media.sql leads to path traversal: '../filedir'. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.3 Build 2025-05-26-1605 is able to address this issue. It is recommended to upgrade the affected component.

EPSS 0.9%VulnerabilityZKTecoGermanyFrance+9