CVE-2026-108795: falha de média gravidade em ZKTeco BioTime
ZKTeco BioTime System Settings API systemSettings access control
Publicada em
10Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Produtos afetados
ZKTeco · BioTimeCVEs relacionadas — ZKTeco BioTime
No mesmo produto, das mais perigosas para as menos.
CVE-2024-6523MEDIUMZKTeco BioTime system-group-add cross site scriptingEPSS 0.5%CVE-2024-13966MEDIUMZKTeco BioTime default passwordEPSS 0.4%CVE-2025-15128MEDIUMZKTeco BioTime Endpoint safe_setting credentials storageEPSS 0.3%CVE-2026-108798MEDIUMZKTeco BioTime hard-coded keyEPSS —CVE-2026-108797MEDIUMZKTeco BioTime Employee REST API employees authorizationEPSS —CVE-2026-108796MEDIUMZKTeco BioTime Biometric Data Endpoint finger_data authorizationEPSS —