CVE-2026-108795
4.3MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-266, CWE-284
Impact
Authenticated remote users can bypass access controls to view unauthorized system settings. An attacker needs valid low-privilege network credentials to exploit the API.
Root cause
Improper access control checks on the /base/api/systemSettings endpoint allow unauthorized reads of system configuration.
Affected systems
ZKTeco BioTime 9.5.6 Build 20260130.3206
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Fix & remediation
Upgrade ZKTeco BioTime to version 9.5.6 Build 3623. If patching immediately is not possible, restrict network access to the BioTime web interface and block access to the /base/api/systemSettings endpoint at your reverse proxy.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. Upgrading to version 9.5.6 Build 3623 can resolve this issue. It is advisable to upgrade the affected component.