ZKTeco BioTime CVE-2026-108794

Exploitation requires an authenticated session - the CVSS vector specifies PR:L, so the attacker needs valid low-privileged BioTime credentials to reach the /base/api/v1.0/systemSettings/db_migrate_setting/ API of the Database Migration component. The endpoint must be network-reachable (AV:N) and no user interaction is needed (UI:N). The key limiting factors are the authentication requirement and access to the system-settings API path; there is no indication the migration endpoint is exposed to fully unauthenticated users. No non-default configuration is stated as required in the description.

This is a medium-severity SQL injection (CWE-74) in the Database Migration functionality of ZKTeco BioTime 9.5.6. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable, low-complexity attack that nonetheless REQUIRES authentication (PR:L) - this is the single biggest risk-limiting factor and keeps the score at 5.3 rather than critical. Impact is rated LOW across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), suggesting the injection yields partial data access/manipulation rather than full database compromise or RCE, though SQL injection impact is often underestimated and could be chained further. No EPSS score, CISA KEV listing, or POC is present in the input, so there is no signal of active exploitation or weaponization. The sole source is VulDB (cna@vuldb.com), and the vendor was contacted but did not respond, meaning there is NO vendor advisory, patch, or independent confirmation of affected-version boundaries. Net assessment: a credible but authenticated, low-impact issue that is a moderate patch-prioritization item, not an emergency - its real priority depends heavily on whether low-privileged BioTime accounts are broadly provisioned in a given deployment.

An attacker who already holds a low-privileged BioTime account (or has phished/obtained one) sends a crafted request to the /base/api/v1.0/systemSettings/db_migrate_setting/ endpoint, injecting malicious SQL into a parameter of the Database Migration function. Because the attack is remote and low-complexity, the attacker can then read or tamper with limited database contents. No public exploit code is identified at time of analysis, so this would require manual crafting of the injection.