CVE-2026-108798 - Vulnerability Details

Description

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key
. The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.

Published: 2026-10-12

Score: 6.9 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a hard‑coded cryptographic key in ZKTeco BioTime 9.5.6 Build 20260130.3206 that can be manipulated, resulting in the use of a fixed key for encryption or authentication, potentially exposing confidential data and allowing remote attackers to compromise the system.

Affected Systems

Affected systems are devices running the specific ZKTeco BioTime build 9.5.6 Build 20260130.3206; no other versions or products are listed as impacted.

Risk and Exploitability

With a CVSS score of 6.9 the vulnerability is moderate in severity, the EPSS score is < 1%, and it is not listed in the CISA KEV catalog. A vendor‑supplied patch to upgrade to version 9.5.6 Build 3623 addresses this issue, reducing the risk. A remote attacker might exploit the flaw by manipulating the device’s input handling.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ZKTeco

BioTime

affected

Version	Status	Constraints
`9.5.6 Build 20260130.3206`	affected	—
`9.5.6 Build 3623`	unaffected	—

No data.

Vendor Product Confidence Versions

Zkteco

Biotime

95%

Version	Status	Scheme	Platform
`9.5.6 Build 20260130.3206`	affected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade ZKTeco BioTime devices to version 9.5.6 Build 3623.
Replace any hard‑coded cryptographic keys with securely generated keys and store them using proper key management mechanisms to address the hard‑coded key weakness (CWE‑320).
Implement strict input validation for all data used in cryptographic operations to mitigate improper use of input in cryptographic parameters (CWE‑321).
Limit remote management and authentication interfaces to trusted networks or isolate the device behind a firewall to reduce exposure.

Generated by OpenCVE AI on October 17, 2026 at 09:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00278.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://vuldb.com/cve/CVE-2026-108798
https://vuldb.com/submit/961812
https://vuldb.com/vuln/416575
https://vuldb.com/vuln/416575/cti
https://www.zkteco.com/en/Security_Bulletinsibs/27

History

Fri, 16 Oct 2026 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 16 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
Description	A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.	A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.
References		https://www.zkteco.com/en/Security_Bulletinsibs/27
Metrics	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}`	cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}`

Mon, 12 Oct 2026 04:15:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title		ZKTeco BioTime hard-coded key
First Time appeared		Zkteco Zkteco biotime
Weaknesses		CWE-320 CWE-321
CPEs		cpe:2.3:a:zkteco:biotime::::::::
Vendors & Products		Zkteco Zkteco biotime
References		https://vuldb.com/cve/CVE-2026-108798 https://vuldb.com/submit/961812 https://vuldb.com/vuln/416575 https://vuldb.com/vuln/416575/cti
Metrics		cvssV2_0 `{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}` cvssV3_0 `{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}`

Subscriptions

Zkteco Biotime

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-12T04:00:12.485Z

Updated: 2026-10-16T12:45:54.553Z

Reserved: 2026-10-11T09:11:26.300Z

Link: CVE-2026-108798

Vulnrichment

Updated: 2026-10-14T17:24:08.486Z

NVD

Status : Deferred

Published: 2026-10-12T04:16:48.903

Modified: 2026-10-16T13:16:54.757

Link: CVE-2026-108798

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-17T09:30:05Z

Weaknesses

CWE-320
CWE-321
Use of Hard-coded Cryptographic Key

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object