CVE-2026-108795 in BioTime
Summary
by MITRE • 10/12/2026
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The identified vulnerability resides within ZKTeco BioTime version 9.5.6, specifically targeting the System Settings API endpoint located at /base/api/systemSettings. This component is critical for managing configuration parameters that dictate how the biometric attendance and access control system operates. The core technical flaw involves improper access controls associated with an unknown functionality of this specific API interface. In a properly secured application programming interface, endpoints handling sensitive administrative or system-level configurations must enforce strict authentication and authorization checks to ensure that only privileged users can modify these settings. However, in this instance, the implementation fails to adequately verify the identity or privilege level of the requesting entity before processing changes to system parameters. This lack of robust access control allows an attacker who has network connectivity to the service to manipulate configuration values without valid credentials or with insufficient privileges.
From a technical perspective, this flaw aligns closely with CWE-284, which describes Improper Access Control. The vulnerability enables remote attackers to alter critical system settings by sending crafted HTTP requests to the specified endpoint. Because the access control mechanism is bypassed or entirely missing for certain operations within this API, an attacker can potentially change security policies, disable logging features, modify user permissions, or otherwise destabilize the operational integrity of the BioTime platform. The ability to initiate such attacks remotely means that no physical proximity or local account compromise is required, significantly lowering the barrier to entry for malicious actors who may exploit this weakness as part of a broader attack chain against organizational security infrastructure.
The operational impact of this vulnerability is substantial given the nature of ZKTeco BioTime systems in enterprise environments. These platforms often serve as the central hub for employee attendance tracking and physical access control, meaning that compromising their configuration can lead to significant disruptions in business operations. An attacker could manipulate settings to allow unauthorized individuals into secure areas by altering access rules or disable audit trails to cover subsequent malicious activities. Furthermore, if system integrity is compromised, it may affect the accuracy of timekeeping data used for payroll processing, leading to financial discrepancies and administrative overhead. The lack of response from the vendor regarding this disclosure exacerbates the risk, as organizations relying on this software are left without official patches or guidance on how to mitigate the issue through supported channels.
To address these risks, immediate mitigation strategies should focus on network-level controls since a patch is not currently available. Administrators should restrict access to the BioTime server and specifically the /base/api/systemSettings endpoint using firewall rules or web application firewalls that limit connectivity to trusted IP addresses only. Implementing strict authentication requirements for all API endpoints, even those previously exposed without checks, can help reduce the attack surface. Additionally, enabling comprehensive logging on the web server hosting this component is essential to detect any unauthorized attempts to access or modify system settings. Organizations should also consider isolating critical biometric and attendance systems within a segmented network zone to prevent lateral movement in case of other compromises. Regular audits of API configurations against industry standards such as OWASP API Security Top 10, particularly regarding broken object level authorization, are recommended to identify similar weaknesses before they can be exploited.