GHSA-6gw7-6qw6-6pq6CriticalCVSS 9.8
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via...
🔗 CVE IDs covered (1)
📋 Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.
🔗 References (6)
- https://nvd.nist.gov/vuln/detail/CVE-2026-125297
- https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json
- https://www.asiainfo.eu/cloudbss
- https://www.cve.org/CVERecord?id=CVE-2026-125297
- https://github.com/advisories/GHSA-6gw7-6qw6-6pq6