CVE-2026-108798
Received Received - Intake

Hard-Coded Cryptographic Key in ZKTeco BioTime

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulDB

Description
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-108798
EUVD
EUVD-2026-97169

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ZKTeco BioTime 9.5.6 Build 20260130.3206

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-320 Key Management Errors
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the use of a hard-coded cryptographic key in ZKTeco BioTime 9.5.6 Build 20260130.3206. The issue arises from unknown processing that allows an attacker to remotely exploit this weakness, potentially gaining unauthorized access or manipulating system behavior.

Detection Guidance

This vulnerability involves a hard-coded cryptographic key in ZKTeco BioTime 9.5.6 Build 20260130.3206. Detection requires checking for hard-coded keys in the application or network traffic analysis for unusual cryptographic operations. No specific commands are provided in the context.

Impact Analysis

The vulnerability may allow remote attackers to bypass security measures due to the hard-coded key. This could lead to unauthorized access, data breaches, or system manipulation. The impact depends on the system's configuration and exposure to the internet.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using this software may face legal penalties, reputational damage, and loss of trust due to non-compliance with data protection standards.

Mitigation Strategies

Immediately update ZKTeco BioTime to the latest version if available. Isolate affected systems from the network to prevent remote exploitation. Review and replace any hard-coded cryptographic keys in use. Monitor for unusual activity or unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108798. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart