Description
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key
. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Potential confidentiality breach due to hard‑coded cryptographic key
Action: Assess impact
AI Analysis

Impact

The vulnerability is a hard‑coded cryptographic key in ZKTeco BioTime 9.5.6 Build 20260130.3206 that can be manipulated, leading to the use of a fixed key for encryption or authentication, which in turn exposes data confidentiality and integrity to a remote attacker.

Affected Systems

Affected systems are devices running the specific ZKTeco BioTime build 9.5.6 Build 20260130.3206; no other versions or products are listed as impacted.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability is moderate in severity, the EPSS score is not available, and it is not listed in the CISA KEV catalog; a remote attacker might exploit the flaw by manipulating the device’s input handling, though no official fix is currently available from the vendor, thus the main risk is the potential exposure of encrypted data

Generated by OpenCVE AI on October 12, 2026 at 05:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Confirm whether any BioTime devices in your environment are running the affected version 9.5.6 Build 20260130.3206.
  • Limit network exposure of the device by placing it behind a firewall or isolating it from untrusted networks.
  • Schedule a firmware upgrade pending the vendor’s official patch, or temporarily disable the cryptographic feature if the device permits.
  • Monitor for anomalous cryptographic activity and alert on failed authentication attempts.

Generated by OpenCVE AI on October 12, 2026 at 05:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 12 Oct 2026 04:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title ZKTeco BioTime hard-coded key
First Time appeared Zkteco
Zkteco biotime
Weaknesses CWE-320
CWE-321
CPEs cpe:2.3:a:zkteco:biotime:*:*:*:*:*:*:*:*
Vendors & Products Zkteco
Zkteco biotime
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Zkteco Biotime
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-12T04:00:12.485Z

Reserved: 2026-10-11T09:11:26.300Z

Link: CVE-2026-108798

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-12T04:16:48.903

Modified: 2026-10-12T04:16:48.903

Link: CVE-2026-108798

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T05:30:06Z

Weaknesses