ZKTeco BioTime v8.5.5 (iclock API path traversal): Unauthenticated arbitrary file read on the BioTime server

Impact

Unauthenticated arbitrary file read on the BioTime server via the iclock API - and this one is in CISA's Known Exploited Vulnerabilities catalog, meaning it is being used against real targets, not theorised about. BioTime is the time-and-attendance and access management server that pairs with ZKTeco terminals, so the files worth reading include its configuration, database credentials and the stored data on who badges in where and when. Combined with the companion issues in the same disclosure set (an unauthenticated administrator password reset via a hidden API, and authenticated arbitrary file write) an attacker moves from file read to full control of the access-management server, and from there to door control. The KEV listing should drive urgency: if you have BioTime anywhere in the facility, treat it as a live target. Personnel movement data is also a targeting asset in its own right - it tells an attacker when the hall is unstaffed.

Who can reach it

Unauthenticated HTTP to the BioTime server's iclock API. BioTime is commonly published to the corporate network for HR and facilities use, and internet exposure is not rare because the product is sold on remote attendance management. Active exploitation is confirmed, so assume internet-reachable instances are already being scanned.

What to do

Patch immediately to BioTime 9.0.1 (build 20240617.19506) or later per the vendor - and because this is KEV-listed with a known-exploited history, patching is not the end of the work: assume compromise on any instance that was internet-reachable, rotate the database and administrator credentials, audit the cardholder and access-rule data against a known-good baseline, and review door-open events for the exposure window. Then remove BioTime from internet and general corporate reachability entirely. If it is running on a server that also holds anything else, isolate it.

References