Maple Labs

CVE search · CVE-2026-125297

CVE-2026-125297

critical 9.3

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

Open in the NVD CVE.org JSON

Details

Status
Received
Published
Last changed
Source
9119a7d8-5eab-497f-8521-727c672e3725
Weakness
CWE-306, CWE-862

Severity

VersionScoreVectorSource
CVSS 4.0 critical 9.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X 9119a7d8-5eab-497f-8521-727c672e3725Secondary
CVSS 3.1 critical 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 9119a7d8-5eab-497f-8521-727c672e3725Secondary

References