| Title | ZKTeco BioTime 9.5.6 Build 20260130.3206 Cryptographic Issues |
|---|
| Description | ZKTeco BioTime (ZKBioTime) 9.5.6 Build 20260130.3206 uses hard-coded cryptographic keys embedded in the shipped application to protect sensitive stored credentials and configuration secrets.
The same cryptographic key material is present in the application rather than being uniquely generated or securely provisioned per installation. As a result, an attacker who obtains a copy of the BioTime application can recover secrets protected using these cryptographic mechanisms without requiring the original installation-specific encryption key.
The affected application contains multiple hard-coded cryptographic schemes used by functions responsible for encrypting and decrypting stored secrets.
The identified key material includes:
- zkEncrypt/zkDecrypt: RC4 using the hard-coded key "biotime"
- aes_encrypt/aes_decrypt: AES-192-CBC using the hard-coded key "china@2018encryption#aes" and IV "zkteco@china2019"
- QR-related encryption: AES-128-CBC using the hard-coded value "secretkeysecretk" as the key and IV
These values are embedded in the shipped application and are not unique per BioTime installation.
Sensitive configuration values protected using these mechanisms include credentials and other secrets such as database passwords, backup passwords, LDAP passwords, and export encryption passwords.
Because the cryptographic key material is available in the application itself and is reused across installations, the encryption does not provide effective protection against an attacker who can obtain the application.
For example, an AES-192-CBC protected secret can be decrypted using the hard-coded cryptographic material present in the application:
AES key:
"china@2018encryption#aes"
IV:
"zkteco@china2019"
The attacker does not need a secret supplied by the affected BioTime installation to perform this decryption.
Attack flow:
1. An attacker obtains a copy of the BioTime application or otherwise gains access to the shipped application code.
2. The attacker extracts the hard-coded cryptographic key material from the application.
3. The attacker obtains an encrypted credential or other protected secret from a BioTime installation.
4. The attacker applies the corresponding hard-coded cryptographic algorithm and key.
5. The protected secret can be recovered without possession of an installation-specific cryptographic key.
Impact:
Successful exploitation defeats the intended confidentiality protection of secrets encrypted using the affected mechanisms. Depending on which protected secret is obtained, an attacker may recover database credentials, backup credentials, LDAP credentials, export encryption passwords, or other sensitive configuration values.
This issue also undermines the security of encrypted credentials across BioTime installations because the same cryptographic material is embedded in the application rather than being unique to each installation.
The issue was reported to ZKTeco through its security reporting channel. ZKTeco subsequently confirmed that its R&D team fixed this vulnerability. At the time of submission, the exact publicly released fixed version/build had not been provided.
CVSS v3.1: 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CWE:
- CWE-321: Use of Hard-coded Cryptographic Key
- CWE-798: Use of Hard-coded Credentials |
|---|
| User | bashdar (UID 101020) |
|---|
| Submission | 09/05/2026 14:32 (2 months ago) |
|---|
| Moderation | 10/11/2026 11:11 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416575 [ZKTeco BioTime 9.5.6 Build 20260130.3206 hard-coded key] |
|---|
| Points | 17 |
|---|