{"id":"CVE-2026-125297","published":"2026-11-10T22:18:30.080","lastModified":"2026-11-10T22:18:30.080","description":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md","tags":[]},{"url":"https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.json","tags":[]},{"url":"https://www.asiainfo.eu/cloudbss","tags":[]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-125297","tags":[]}],"exploitRefs":[{"url":"https://github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.md","tags":[]}],"hasPoc":true,"ai":{"summary":"The AsiaInfo BSS 9.2.0–9.2.40 management API endpoint '/bss/sysmgnt/api/' lacks authentication, allowing unauthenticated remote attackers to perform administrative actions such as creating privileged accounts or taking over existing ones. This critical flaw stems from missing access controls (CWE-862) and the absence of authentication checks (CWE-306).","exploitability":"Exploitation is trivial for any remote attacker with network access to the vulnerable endpoint; no authentication, user interaction, or special conditions are required.","blast_radius":"Successful exploitation grants full administrative control over the BSS, enabling complete compromise of customer data, billing manipulation, service disruption, and lateral movement within connected systems.","remediation":"Upgrade to AsiaInfo BSS version 9.2.41 or later to patch the authentication bypass vulnerability in the '/bss/sysmgnt/api/' endpoint.","detection":"Defenders should monitor for unauthenticated HTTP requests to '/bss/sysmgnt/api/' endpoints, especially POST/PUT/DELETE operations targeting user management or configuration APIs, and correlate with successful administrative actions (e.g., new admin accounts, privilege escalations) in application logs. No reliable host-based indicators are derivable from the published description.","tags":["auth-bypass","admin-privilege-escalation","web-api","unauthenticated-access","critical-severity"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:53:09.205Z"}}