Description

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T04:16:48.173Z",
  "pubdate": "2026-10-12T04:16:48.173Z",
  "executiveSummary": "A critical authorization bypass vulnerability has been identified in ZKTeco BioTime 9.5.6 Build 20260130.3206 within the Biometric Data Endpoint component.\nThe vulnerability resides in the /iclock/finger_data/ file and is triggered by the improper handling of the 'emp_code' argument.\nAn unauthenticated, remote attacker can exploit this flaw to bypass established access controls, potentially leading to unauthorized interaction with biometric data handling processes.\nThe risk is significant as the vulnerability allows for remote exploitation without requiring prior authentication, exposing sensitive biometric data management interfaces.\nThe vendor has not provided a response or a patch, leaving systems currently deployed in production environments vulnerable to exploitation.",
  "technicalDetails": "The vulnerability is localized within the Biometric Data Endpoint, specifically targeting the logic processing requests to the /iclock/finger_data/ endpoint.\nThe root cause is an insecure implementation of access control mechanisms where the 'emp_code' parameter is inadequately sanitized or validated during the backend processing of biometric data requests.\nThe attack flow initiates with a remote HTTP request directed at the /iclock/finger_data/ resource. By manipulating the 'emp_code' argument, an attacker can bypass the intended authorization logic that should restrict access based on valid user sessions or administrative permissions.\nBecause the server fails to verify the requestor's authorization status against the requested 'emp_code' resource, the endpoint incorrectly grants access to the underlying functionality.\nThis behavior suggests that the application relies on client-side-supplied identifiers for server-side authorization decisions without performing an integrity check or a server-side session validation mapping the 'emp_code' to an authenticated user context.\nThe exploitation does not require the attacker to have legitimate credentials, as the vulnerability affects the authorization check phase itself rather than the authentication phase.\nSuccessful exploitation results in an authorization bypass, potentially allowing an attacker to manipulate, extract, or interact with biometric data records associated with arbitrary employee codes.\nThis exposes the organization to the unauthorized disclosure or corruption of biometric information, which is a critical security violation.\nGiven the nature of the endpoint, the impact extends beyond mere unauthorized access, as it compromises the integrity of the BioTime system's biometric infrastructure.\nWithout a vendor patch, the system remains susceptible to remote, unauthenticated manipulation of sensitive endpoints."
}