Description
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Improper access control leading to unauthorized system settings modification
Action: Assess Impact
AI Analysis

Impact

The vulnerability is an improper access control flaw in the System Settings API endpoint /base/api/systemSettings of ZKTeco BioTime 9.5.6 Build 20260130.3206. By manipulating this endpoint, an attacker can bypass authentication or authorization checks to alter system configuration settings remotely, potentially enabling unauthorized modification of critical parameters and compromising system integrity.

Affected Systems

ZKTeco BioTime 9.5.6 Build 20260130.3206 on the ZKTeco platform. The affected component is the System Settings API endpoint located at /base/api/systemSettings.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate risk for unauthorized configuration changes. An EPSS score of <1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely, likely requiring network access to the device. Consequently the vulnerability poses a moderate threat that should be evaluated by administrators.

Generated by OpenCVE AI on October 17, 2026 at 08:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Contact ZKTeco to request a patch or upgrade to a version that resolves the improper access control flaw.
  • Restrict network access to the /base/api/systemSettings endpoint using firewall rules or network segmentation to limit remote exposure.
  • Enable logging and monitoring of all API activity for the System Settings endpoint and review logs for unauthorized configuration changes.

Generated by OpenCVE AI on October 17, 2026 at 08:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

 cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

Tue, 13 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime System Settings API systemSettings access control
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T12:45:42.116Z

Reserved: 2026-10-11T09:11:15.079Z

Link: CVE-2026-108795

cve-icon Vulnrichment

Updated: 2026-10-13T14:26:54.343Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T04:16:43.580

Modified: 2026-10-16T13:16:54.350

Link: CVE-2026-108795

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T08:15:05Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control