Vulnerability · Published Oct 12, 2026 · Assigned by VulDB
CVE-2026-108798ZKTeco BioTime hard-coded key
High 7.3
In plain English
A high-severity security flaw in BioTime from ZKTeco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 79.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is capable of addressing this issue. It is suggested to upgrade the affected component.
Affected products (as reported)
Weakness: CWE-321, CWE-320 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-416575 | ZKTeco BioTime hard-coded key vdb-entry
- VDB-416575 | CTI Indicators (IOB, IOC, TTP) signature, permissions-required
- CVE-2026-108798 | CVE Analysis and Report third-party-advisory
- Submit #961812 | ZKTeco BioTime 9.5.6 Build 20260130.3206 Cryptographic Issues third-party-advisory
- https://www.zkteco.com/en/Security_Bulletinsibs/27 patch