CVE-2026-108794
6.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-74, CWE-89
Impact
Authenticated remote attackers can execute arbitrary SQL queries against the underlying database. They only need low-privilege network access to the web interface to manipulate system settings.
Root cause
Improper input sanitization allows SQL injection in the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint of the database migration functionality.
Affected systems
ZKTeco BioTime 9.5.6 Build 20260130.3206
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade ZKTeco BioTime to version 9.5.6 Build 3623. If patching immediately is not possible, restrict network access to the BioTime management interface or block traffic to the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised.