CVE-2026-108794: ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZKTeco BioTimeto a version that resolves this vulnerability.Fixed in 9.5.6 Build 3623
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs low-level privileges (PR:L). Exploitation can be performed remotely and does not require user interaction.
What security impact could successful exploitation have?
The reported CVSS metrics indicate low impact to confidentiality, integrity, and availability. The vulnerability is classified as SQL injection, so successful exploitation may allow manipulation of database queries through the affected database-migration settings functionality.
Which deployment should be prioritized for investigation?
Prioritize ZKTeco BioTime 9.5.6 Build 20260130.3206 instances where low-privileged users can reach the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint remotely. The available information does not state whether this endpoint is enabled or reachable in a default configuration.
Is a vendor fix or workaround available?
The provided information does not identify a patch, fixed release, or workaround. It states that the vendor was contacted but did not respond.