Description
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote SQL injection
Action: Patch Immediately
AI Analysis

Impact

A vulnerability in the database migration functionality of ZKTeco BioTime allows an attacker to inject arbitrary SQL through the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint. The flaw can be triggered remotely and may enable the execution of unintended database commands, leading to disclosure, modification, or deletion of sensitive data stored in the system. The weakness is reported as a classic SQL injection flaw, classified under CWEs 74 and 89.

Affected Systems

The affected product is ZKTeco BioTime version 9.5.6 Build 20260130.3206. Only this build of the BioTime software is known to contain the unpatched sql injection vulnerability in the database migration feature.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. EPSS information is not available, but the vulnerability is accessible from the internet through the specified API, implying that an external attacker could exploit it without local access. The feature is not listed in the CISA KEV catalog, so no common exploitation has been documented yet. Without mitigation, the flaw provides a pathway for attackers to compromise data integrity and confidentiality across the entire BioTime database environment.

Generated by OpenCVE AI on October 12, 2026 at 04:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ZKTeco BioTime to the latest released firmware that includes the SQL injection fix.
  • Configure firewall or network ACLs to limit access to the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint to trusted administrative IPs only.
  • Implement input validation and use parameterized queries in the migration API to prevent execution of unexpected SQL statements.

Generated by OpenCVE AI on October 12, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 03:15:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T03:00:08.022Z

Reserved: 2026-10-11T09:11:11.621Z

Link: CVE-2026-108794

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T03:17:18.343

Modified: 2026-10-12T03:17:18.343

Link: CVE-2026-108794

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T04:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')