Description
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Authorization Bypass
Action: Patch
AI Analysis

Impact

A flaw in ZKTeco BioTime 9.5.6 allows manipulation of the emp_code argument to bypass authorization in the Biometric Data Endpoint. This vulnerability can expose biometric data and other sensitive information without proper authentication. The attack is remotely executable, requiring only the ability to send crafted requests to the /iclock/finger_data/ endpoint, and has been acknowledged by the vendor but no response has been issued.

Affected Systems

The affected product is ZKTeco BioTime version 9.5.6 Build 20260130.3206, specifically the Biometric Data Endpoint component located at /iclock/finger_data/. No other versions or products are listed as affected.

Risk and Exploitability

The CVSS score of 5.3 indicates medium severity. EPSS is not available, so exploitation probability cannot be inferred. The vulnerability is not currently listed in the CISA KEV catalog. Attackers can remotely manipulate emp_code to bypass authorization, leveraging weaknesses identified as CWE-285 and CWE-639. Because the vendor has not provided a fix, the flaw remains exploitable.

Generated by OpenCVE AI on October 12, 2026 at 04:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official patch or upgrade to a newer version of ZKTeco BioTime that removes the flaw; if no patch is available, contact ZKTeco to request a fix
  • Restrict external access to the /iclock/finger_data/ endpoint by configuring firewall rules or network segmentation so that only authenticated internal users can reach it
  • Implement additional application‑level checks to ensure that the emp_code value is validated against the authenticated user’s permissions before granting data access
  • Test the system in a staging environment to confirm that manipulation of emp_code no longer grants unauthorized access and document the validation steps

Generated by OpenCVE AI on October 12, 2026 at 04:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 03:45:00 +0000

Type Values Removed Values Added
Description A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime Biometric Data Endpoint finger_data authorization
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-285
CWE-639
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T03:30:15.059Z

Reserved: 2026-10-11T09:11:18.829Z

Link: CVE-2026-108796

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T04:16:48.173

Modified: 2026-10-12T04:16:48.173

Link: CVE-2026-108796

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T04:30:06Z

Weaknesses
  • CWE-285

    Improper Authorization

  • CWE-639

    Authorization Bypass Through User-Controlled Key