Title: iTA 7 terminals (except G2) – remote code execution in PHP (PHP2Shell, CVE-2026-109618, CVE-2026-109619)
Published: 2026-10-23
Last updated: 2026-10-23
Severity: Critical
Summary
The web interface of iTA 7 attendance terminals (all models except G2) uses PHP versions affected by two critical vulnerabilities known as “PHP2Shell” (CVE-2026-109618, CVE-2026-109619). An unauthenticated attacker with network access to the terminal can execute arbitrary code on the device. The vulnerabilities are being actively exploited. The affected products are no longer supported, and no security update will be provided. Customers should restrict network access to the terminals immediately and plan their replacement.
Affected products
All iTA 7 attendance terminals whose type designation does not end with “G2”, in all hardware and firmware versions. Some of these terminals were sold under the name ZWS terminal or ZWS Pro; they are affected as well.
| Order code | Product series | Product name |
|---|---|---|
| 098756 | iTA 7 | iTA 7 G terminal – no reader + FPC black-silver |
| 092217 | iTA 7 | iTA 7 G terminal – no reader black-silver |
| 092196 | iTA 7 | iTA 7 G terminal – RFID 1200-A black-silver |
| 092197 | iTA 7 | iTA 7 G terminal – RFID 2000-A black-silver |
| 091656 | iTA 7 | iTA 7 G terminal – RFID EM4100 black-silver |
| 081786 | iTA 7 | iTA 7 G terminal – RFID EM4100 black-silver IP65 |
| 081785 | iTA 7 | iTA 7 G terminal – RFID EM4100.WiFi black-silver IP65 |
| 091651 | iTA 7 | iTA 7 G terminal – RFID Hitag 2 black-silver |
| 091647 | iTA 7 | iTA 7 G terminal – RFID Hitag 2 E black-silver |
| 091650 | iTA 7 | iTA 7 G terminal – RFID Hitag2 E + Mifare black-silver |
| 091653 | iTA 7 | iTA 7 G terminal – RFID ICODE black-silver |
| 086473 | iTA 7 | iTA 7 G terminal – RFID JA125 Mifare black-silver |
| 081754 | iTA 7 | iTA 7 G terminal – RFID Mifare black-silver IP65 |
| 082671 | iTA 7 | iTA 7 G terminal – RFID Mifare black-silver WiFi |
| 081755 | iTA 7 | iTA 7 G terminal – RFID Mifare.WiFi black-silver IP65 |
| 091652 | iTA 7 | iTA 7 G terminal – RFID Multi1 black-silver |
| 091655 | iTA 7 | iTA 7 G terminal – RFID Multi2 black-silver |
| 092195 | iTA 7 | iTA 7 G terminal – RFID+FPC Mifare black-silver |
| 091654 | iTA 7 | iTA 7 G terminal – RFID+FPO Mifare black-silver |
| 092537 | iTA 7 | iTA 7 IP54 terminal – iButton |
| 092517 | iTA 7 | iTA 7 IP54 terminal – RFID Mifare |
| 096226 | iTA 7 | iTA 7 terminal – EMV black-silver |
| 094271 | iTA 7 | iTA 7 terminal – iButton + FPC Mifare black-silver |
| 095791 | iTA 7 | iTA 7 terminal – iButton black-silver |
| 094677 | iTA 7 | iTA 7 terminal – no reader + FPC black-silver |
| 099794 | iTA 7 | iTA 7 terminal – no reader + FPC black-silver |
| 092218 | iTA 7 | iTA 7 terminal – no reader black-silver |
| 095638 | iTA 7 | iTA 7 terminal – RFID 1200-A + FPC black-silver |
| 092193 | iTA 7 | iTA 7 terminal – RFID 1200-A black-silver |
| 092194 | iTA 7 | iTA 7 terminal – RFID 2000-A black-silver |
| 095606 | iTA 7 | iTA 7 terminal – RFID EM4100 + FPC Mifare black-silver |
| 099185 | iTA 7 | iTA 7 terminal – RFID EM4100 + FPC WiFi black-silver |
| 091485 | iTA 7 | iTA 7 terminal – RFID EM4100 black-silver |
| 702997 | iTA 7 | iTA 7 terminal – RFID Hitag 2 black-silver |
| 091638 | iTA 7 | iTA 7 terminal – RFID Hitag 2 E black-silver |
| 091641 | iTA 7 | iTA 7 terminal – RFID Hitag2 E + Mifare black-silver |
| 091644 | iTA 7 | iTA 7 terminal – RFID ICODE black-silver |
| 094438 | iTA 7 | iTA 7 terminal – RFID JA125 + FPC Mifare black-silver |
| 096201 | iTA 7 | iTA 7 terminal – RFID JA125 Mifare black-silver |
| 092192 | iTA 7 | iTA 7 terminal – RFID MIfare + FPC Mifare black-silver |
| 096054 | iTA 7 | iTA 7 terminal – RFID MIfare + FPC WiFi black-silver |
| 702996 | iTA 7 | iTA 7 terminal – RFID Mifare black-silver |
| 702998 | iTA 7 | iTA 7 terminal – RFID Mifare silver |
| 091643 | iTA 7 | iTA 7 terminal – RFID Multi1 black-silver |
| 091645 | iTA 7 | iTA 7 terminal – RFID Multi2 black-silver |
| 706070 | iTA 7 | iTA 7 terminal – RFID+FPO Mifare black-silver |
| 091649 | iTA 7 | ZWS Pro 40.10 – RFID Mifare.black-silver |
| 702992 | iTA 7 | ZWS terminal – RFID Hitag 2 black |
| 703157 | iTA 7 | ZWS terminal – RFID Hitag 2 grey |
| 702999 | iTA 7 | ZWS terminal – RFID Hitag 2 silver |
| 702991 | iTA 7 | ZWS terminal – RFID Mifare black |
| 703158 | iTA 7 | ZWS terminal – RFID Mifare grey |
| 092928 | iTA 7 | ZWS terminal – RFID Mifare, HID Class black silver |
| 706098 | iTA 7 | ZWS terminal – RFID Mifare, HID Class grey |
Fixed version: none. These products are no longer supported, and no security update will be provided.
Products not affected
iTA 7 G2 terminals are not affected, because they do not contain PHP. The type designation on the type label of G2 terminals ends with G2, for example “iTA 7 G terminal – RFID EM4100 black-silver G2”.
Order codes of G2 products: 021341, 023095, 085193, 085194, 085195, 085196, 085197, 085198, 087322, 088309, 088578, 088579, 088844, 089334, 089335.
Terminals whose type designation does not end with “G2”, for example “iTA 7 G terminal – RFID EM4100 black-silver”, are affected.
Description
CVE-2026-109618 and CVE-2026-109619 are memory safety vulnerabilities in the PHP interpreter. They are triggered while PHP processes an incoming HTTP request, before any application code runs. Any request to the web interface of the terminal can therefore reach the vulnerable code, including requests sent without logging in.
The affected terminals run PHP 5.4 or PHP 7.0, depending on the hardware revision. These PHP versions are no longer supported by the PHP project, and no fix is available for them.
The affected terminals also contain other outdated software components that no longer receive security updates. Further vulnerabilities in these components must be assumed. For this reason, the mitigation below covers all incoming connections to the terminal, not only the web interface.
Exploitation of these vulnerabilities in the wild has been publicly reported since October 2026.
Security impact
A successful attack allows remote code execution on the terminal and can lead to full control of the device, including administrative (root) privileges. An attacker can:
- read personal data stored in the terminal, including employee data, card identifiers and fingerprint templates;
- modify the configuration and data of the terminal, including attendance records;
- control the relay output of the terminal; where the relay is connected to a door, open the door;
- make the terminal unavailable;
- use the terminal as a foothold for further attacks in the local network.
Conditions for exploitation:
- network access to the web interface of the terminal (TCP port 80);
- no authentication is required;
- no user interaction is required;
- the default configuration of the terminal is affected.
Resolution
The affected products are no longer supported. No security update will be provided.
We recommend replacing the affected terminals with the currently supported iTA 7 G2 terminal. For a replacement offer, please contact your supplier or our sales department: ita@mobatime.cz.
Mitigation
Until the terminals are replaced, apply the following measures immediately:
- Block all incoming network connections to the terminal using a firewall, access control lists, or a separate VLAN. This includes the web interface (TCP port 80) and any other services running on the terminal. Incoming connections are only needed to configure the terminal. If configuration is needed, allow access to the web interface only from one dedicated management workstation and only for the duration of the configuration.
- Allow only outgoing connections from the terminal to the time and attendance server (TCP port 443, or TCP port 80 in some installations). This is a separate firewall rule. The terminal does not need any incoming connections for normal operation.
- Never expose the terminal to the internet.
- Place the terminal in a separate network segment.
These measures reduce the risk of exploitation. They do not remove the vulnerability.
Indicators of compromise
If the web interface of a terminal was reachable from an untrusted network, check for signs of compromise, for example unexpected changes in the configuration or data of the terminal.
If you suspect that a terminal was compromised, disconnect it from the network and contact us at security@mobatime.cz. A restart does not remove a compromise. A compromised terminal must be replaced.
References
- CVE-2026-109618
- CVE-2026-109619
Revision history
| Date | Revision | Description |
|---|---|---|
| 2026-10-23 | 1.0 | Initial publication |