PT-2026-144820

CVE-2026-125297

Published

2026-11-10

Updated

2026-11-11

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40

Description The system accepts unauthenticated requests via the management API endpoint '/bss/sysmgnt/api/'. This allows a remote attacker to provision new accounts with administrative privileges, take over existing accounts, or perform other administrative actions.

Recommendations Update to version 9.2.41. Restrict access to the '/bss/sysmgnt/api/' endpoint to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Trevor Kaon

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

CWE-306: Missing Authentication for Critical Function