CVE-2026-108798: ZKTeco BioTime hard-coded key
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered potentially affected?
The reported affected product is ZKTeco BioTime version 9.5.6 Build 20260130.3206. The available information does not identify which processing component or configurations are affected.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. This suggests a remote attacker could attempt exploitation without an account.
What is the potential impact if exploitation succeeds?
The severity vector indicates low impacts to confidentiality, integrity, and availability. The issue is described as use of a hard-coded cryptographic key.
Is a vendor fix or mitigation available?
No fix, workaround, or mitigation is provided in the available information. The disclosure states that the vendor was contacted but did not respond.