ZKTeco BioTime CVE-2026-108795

Exploitation targets the System Settings API exposed at /base/api/systemSettings in ZKTeco BioTime 9.5.6 Build 20260130.3206 and requires the attacker to already possess a low-privilege authenticated account (CVSS PR:L) with network reachability to the BioTime web application. The limiting factors are the need for valid low-privilege credentials or session access and the fact that impact is confined to confidentiality of system settings (VC:L; no integrity or availability impact); no user interaction is required (UI:N) and complexity is low (AC:L). Note the description/tag ('Authentication Bypass') suggests unauthenticated access, but the CVSS vector indicates authentication is required - confirm with the vendor which boundary is actually crossed.

This is a low-to-moderate priority issue despite the 'Authentication Bypass' tag. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) describes a network-reachable, low-complexity flaw that nevertheless REQUIRES existing low privileges (PR:L) and yields only limited confidentiality impact (VC:L) with no integrity or availability effect - consistent with CWE-284 (improper access control) exposing a System Settings API endpoint to users who should not reach it. The 5.3 score and the single VC:L impact indicate information disclosure / unauthorized read of settings rather than full takeover. Critically, the 'Authentication Bypass' tag CONFLICTS with the CVSS PR:L metric: a true authentication bypass would be PR:N, so the vector implies an authenticated-but-under-privileged actor rather than an unauthenticated one - verify the exact privilege boundary with the vendor. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, and the sole source is VulDB with no corroborating vendor advisory (the vendor was contacted and did not respond). With no exploitation-probability signal and no active-exploitation evidence, this reads as a genuine but lower-tier access-control weakness, not an urgent widespread threat.

An attacker who already holds a low-privilege BioTime account (or has obtained one) sends crafted requests directly to the /base/api/systemSettings endpoint, which fails to properly enforce access controls, allowing them to read or manipulate system settings they should not be authorized to access. The attack is performed remotely over the network with low complexity. No public exploit code is identified at time of analysis.