Skip to content

CVE-2026-125297 AsiaInfo Business Support System (BSS) Missing Authentication

CriticalCVSS 9.3
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

Affected products

ProductAffected versionsFixed in
AsiaInfo International Business Support System >= 9.2.0, < 9.2.41 9.2.41
AsiaInfo International aether-menu >= 2.2.1, < 2.2.7 2.2.7

References

  • url product
  • url third-party-advisory
  • url vdb-entry
  • url third-party-advisory