ZKTeco BioTime CVE-2026-108798

Exploitation requires that an attacker obtain the static cryptographic key that ZKTeco BioTime 9.5.6 ships embedded in its code - recoverable by anyone with access to the application binary, installer, or firmware - and then reach a network-exposed BioTime service that relies on that key (per CVSS AV:N/PR:N/UI:N, no authentication or user interaction is needed). The principal limiting factors are that the source does not identify which feature or data the key protects (so realistic impact cannot be confirmed), that only version 9.5.6 Build 20260130.3206 is named as affected, and that the per-dimension impact is Low - meaning the key likely guards a specific data flow rather than enabling full system takeover. No non-default configuration is cited as a prerequisite.

This is a moderate-severity issue (vendor-reported CVSS 4.0 base 6.9) whose signals are mixed and largely unverified beyond a single source (VulDB). The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated weakness, which inflates the base score, but all three impact dimensions are rated Low (VC:L/VI:L/VA:L) - consistent with a hard-coded cryptographic key (CWE-321) that erodes confidentiality/integrity protections rather than granting direct code execution or full compromise. There is no CISA KEV listing and no public proof-of-concept referenced, so there is no public exploit identified at time of analysis; the probability-of-exploitation (EPSS) was not supplied. No SSVC decision data was provided. The practical significance of a hard-coded key depends entirely on what the key protects (session tokens, stored credentials, API traffic) and that detail is absent from the description ('some unknown processing'). Net: treat this as a real but secondary-priority hardening issue rather than an urgent emergency - the low per-dimension impacts and absence of exploitation evidence argue against widespread active abuse, while the unauthenticated-remote vector warrants patching once a vendor fix exists. Note the vendor did not respond to disclosure, so an official fix and authoritative impact confirmation may be unavailable.

A remote attacker who knows or recovers the static, hard-coded cryptographic key embedded in ZKTeco BioTime (e.g. extracted from the application binary or firmware) uses it to decrypt, forge, or tamper with data the key is meant to protect, such as session tokens or stored secrets. Because the key is identical across all installations, the same recovered key works against every deployed instance. No public exploit code is identified at time of analysis, and the exact protected asset is not described by the source.