Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-108796— ZKTeco BioTime Biometric Data Endpoint finger_data authorization

Quick assessment

Affected

ZKTeco BioTime

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 ZKTeco BioTime 9.5.6 Build 20260130.3206 中发现了一个安全漏洞。该漏洞影响生物特征数据端点（Biometric Data Endpoint）组件中 /iclock/finger_data/ 文件的某个未知部分。通过操纵参数 emp_code 的值，可导致绕过授权机制。攻击者可远程发起此攻击。厂商已提前获知该漏洞披露信息，但至今未作出任何回应。

CVSS 4.3 · Medium Updated Oct 12, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ZKTeco BioTime Biometric Data Endpoint finger_data authorization

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过用户控制密钥绕过授权机制

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ZKTeco	BioTime	9.5.6 Build 20260130.3206	`cpe:2.3:a:zkteco:biotime::::::::`

II. Public POCs for CVE-2026-108796

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-108796

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-108796

Same Patch Batch · ZKTeco · 2026-10-12 · 5 CVEs total

CVE-2026-108798	7.3 HIGH	ZKTeco BioTime hard-coded key
CVE-2026-108794	6.3 MEDIUM	ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection
CVE-2026-108795	4.3 MEDIUM	ZKTeco BioTime System Settings API systemSettings access control
CVE-2026-108797	4.3 MEDIUM	ZKTeco BioTime Employee REST API employees authorization

IV. Related Vulnerabilities

Same product: BioTime

Same vendor: ZKTeco

Same weakness: CWE-639

V. Comments for CVE-2026-108796

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-108796— ZKTeco BioTime Biometric Data Endpoint finger_data authorization

Quick assessment

Possible ATT&CK Techniques 1 AI

I. Basic Information for CVE-2026-108796

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-108796

III. Intelligence Information for CVE-2026-108796

Same Patch Batch · ZKTeco · 2026-10-12 · 5 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-108796

Leave a comment