Description
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass
Action: Patch
AI Analysis

Impact

A flaw in ZKTeco BioTime 9.5.6 Build 20260130.3206 allows manipulation of the emp_code parameter to bypass authorization controls in the Biometric Data Endpoint located at /iclock/finger_data/. The vulnerability permits an attacker to access the endpoint without proper authentication.

Affected Systems

The affected product is ZKTeco BioTime version 9.5.6 Build 20260130.3206, specifically the Biometric Data Endpoint component located at /iclock/finger_data/. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. EPSS score is less than 1% (approximately 0.00218), suggesting a low probability of exploitation. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can remotely manipulate emp_code to bypass authorization, leveraging weaknesses identified as CWE-285 and CWE-639. Because the vendor has provided a patch, the flaw can be mitigated by upgrading to the fixed version.

Generated by OpenCVE AI on October 17, 2026 at 09:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to version 9.5.6 Build 3623 of ZKTeco BioTime to remove the flaw.
  • Restrict external access to the /iclock/finger_data/ endpoint by configuring firewall rules or network segmentation so that only authenticated internal users can reach it.
  • Implement additional application‑level checks to ensure that the emp_code value is validated against the authenticated user’s permissions before granting data access.
  • Test the system in a staging environment to confirm that manipulation of emp_code no longer grants unauthorized access and document the validation steps.

Generated by OpenCVE AI on October 17, 2026 at 09:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 13:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. Upgrading to version 9.5.6 Build 3623 is able to mitigate this issue. You should upgrade the affected component.
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

 cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'}

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime Biometric Data Endpoint finger_data authorization
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-16T12:45:46.274Z

Reserved: 2026-10-11T09:11:18.829Z

Link: CVE-2026-108796

cve-icon Vulnrichment

Updated: 2026-10-15T13:51:14.600Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T04:16:48.173

Modified: 2026-10-16T13:16:54.493

Link: CVE-2026-108796

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T09:30:05Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key