ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows remote attackers to read any file via the administrative API. Installing required modules Inside the directory ZKTEco: $ pip install -r ./pyzatt/requirementsdev.txt Running the exploit Inside the directory ZKTEco: $ python exploit.py...

ZKTeco BioTime v8.5.5 - Path Traversal

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. id: CVE-2023-38950 info: name: ZKTeco BioTime v8.5.5 - Path Traversal author: iamnoooob,pdresearch severity: high description: | A pa...

CVE-2026-108796

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

CVE-2026-108797

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

CVE-2026-108798

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It i...

CVE-2026-108795

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated...

EUVD-2026-97169

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any...

CVE-2026-108798 ZKTeco BioTime hard-coded key

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It i...

CVE-2026-108798

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key during unknown processing. This flaw can be exploited via a remote attack to compromise cryptographic integrity. The vendor has not responded to the disclosure. No specific remed...

CVE-2026-108797 ZKTeco BioTime Employee REST API employees authorization

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

CVE-2026-108797 ZKTeco BioTime Employee REST API employees authorization

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. Upgrading to version...

EUVD-2026-97168

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be initiated remotely. The vendor was...

CVE-2026-108797

A vulnerability exists in ZKTeco BioTime version 9.5.6 Build 20260130.3206 within the Employee REST API component. Specifically, unknown code in the file /personnel/api/employees/ is susceptible to manipulation, leading to an authorization bypass . This attack can be initiated remotely . No speci...

EUVD-2026-97167

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. The...

CVE-2026-108796 ZKTeco BioTime Biometric Data Endpoint finger_data authorization

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/fingerdata/ of the component Biometric Data Endpoint. Executing a manipulation of the argument empcode can lead to authorization bypass. The attack can be launched remotely. Upgradi...

CVE-2026-108796

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Biometric Data Endpoint component. Specifically, an unknown part of the /iclock/finger_data/ file allows for an authorization bypass when the emp_code argument is manipulated. This attack can be initiated remotely . No ...

CVE-2026-108794

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/dbmigratesetting/ of the component Database Migration Functionality. Such manipulation leads to sql injectio...

CVE-2026-108795

A vulnerability exists in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the System Settings API component. Specifically, an unknown functionality in the file /base/api/systemSettings suffers from improper access controls (CWE-284, CWE-266). An attacker can initiate this attack remotely to manip...