Description

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is some unknown functionality of the file /base/api/systemSettings of the component System Settings API. Performing a manipulation results in improper access controls. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T04:16:43.580Z",
  "pubdate": "2026-10-12T04:16:43.580Z",
  "executiveSummary": "A critical vulnerability exists in the ZKTeco BioTime 9.5.6 Build 20260130.3206 System Settings API. The flaw stems from improper access controls within the /base/api/systemSettings endpoint, which allows unauthorized remote entities to interact with sensitive system configuration functions.\nThis vulnerability is categorized as an improper access control issue, potentially leading to unauthorized modification of system settings. The vulnerability is exploitable remotely, requiring no user interaction, which significantly increases the risk to the confidentiality and integrity of the BioTime instance.\nAttackers can leverage this flaw to bypass intended authentication or authorization mechanisms, effectively performing administrative actions without valid credentials. Given the nature of the application as a time and attendance management system, unauthorized access to system settings could allow an attacker to disrupt services, exfiltrate sensitive metadata, or manipulate system behavior to facilitate further malicious activity.\nThe vendor was notified of this vulnerability but has not provided a resolution. Consequently, organizations utilizing the affected version remain at risk and should prioritize immediate network-level defensive measures.",
  "technicalDetails": "The vulnerability resides in the System Settings API component, specifically targeting the /base/api/systemSettings endpoint. The root cause is a failure to enforce sufficient access control checks on incoming requests to this URI. Despite the sensitive nature of the functionality exposed by this endpoint, the application fails to validate the authorization context of the requester, allowing unauthenticated or low-privileged remote attackers to reach internal configuration management routines.\nThe attack flow begins with an external entity sending a crafted HTTP request directly to the /base/api/systemSettings resource. Because the backend service lacks robust session validation or role-based access control (RBAC) enforcement for this specific API path, the application processes the request as if it originated from a trusted, authorized administrator. The manipulation of this endpoint allows the attacker to view or modify critical system parameters that should strictly be protected behind an authenticated session.\nThe exposure is strictly network-based, meaning any remote attacker capable of reaching the BioTime web service over the network can initiate the exploit. The lack of input validation or strict authorization filtering at the API gateway level means the payload is executed in the application's context without hindrance. Once the attacker successfully triggers the endpoint, they may be able to alter system settings that govern database connectivity, integration keys, or notification configurations, depending on the underlying functions enabled by the API.\nThe post-exploitation impact is severe, as the compromise of system settings provides a vector for full administrative takeover. By reconfiguring the application, an attacker could point the system to a malicious database, disable authentication providers, or establish a foothold for persistence within the ZKTeco ecosystem. As there is no documented patch for version 9.5.6 Build 20260130.3206, the attack surface remains exposed, and remediation must rely on environmental security controls to prevent unauthorized access to the application interface."
}