ZKTeco BioTime CVE-2025-15128

The BioTime web application must be reachable over the network - internet-facing deployments are at greatest risk, though intranet deployments are vulnerable to any internal threat actor. The CVSS 4.0 vector (PR:N/UI:N) and the Authentication Bypass tag confirm no valid credentials or user interaction are required; exploitation targets the default state of the /base/safe_setting/ endpoint. The backup or export encryption features must be present, which are standard capabilities in default BioTime installations. Exploitation is limited to versions 9.0.3, 9.0.4, and 9.5.2 - deployments already running version 9.0.6 or later are not vulnerable. No special protocol, non-default configuration, or specific platform variant is required beyond standard HTTP access to the application.

The CVSS 4.0 score of 5.5 (Medium) reflects a remotely exploitable, no-authentication, no-user-interaction attack profile - signals that individually elevate real-world priority above the numeric band. The confidentiality impact is rated Low (VC:L), which may understate operational risk: if the exposed credentials are backup or export encryption keys, an attacker who obtains them can decrypt sensitive backup archives containing biometric records, employee data, or access control configurations. The public POC on GitHub (ionutluca888/IDOR-POC-ZKBio-Time) removes the research barrier entirely. The vulnerability is not listed in CISA KEV at time of analysis, suggesting targeted rather than mass exploitation so far, but POC availability means that gap can close rapidly. There is no conflicting signal between the CVSS vector and the description - both indicate unauthenticated network exploitation. Security teams with internet-facing BioTime deployments should treat this as higher priority than the base score alone implies.

An unauthenticated attacker with HTTP/HTTPS connectivity to a BioTime instance sends a crafted request to /base/safe_setting/ with manipulated backup_encryption_password_decrypt or export_encryption_password_decrypt parameter values. The server returns or processes decrypted credential material without validating session or identity. A publicly available POC on GitHub (ionutluca888/IDOR-POC-ZKBio-Time) demonstrates this exact technique, meaning the attacker requires minimal skill to execute the attack and obtain encryption passwords that can be used to decrypt sensitive backup archives.