CVE-2026-125297: Critical severity AsiaInfo Business Support System (BSS) vulnerability

Q: Which deployments are affected?

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 are affected. Version 9.2.41 fixes the issue.

Q: Does exploitation require credentials or user interaction?

No. The vulnerable management API accepts unauthenticated requests, so a remote attacker does not need an account, privileges, or user interaction.

Q: What access could an attacker gain?

An attacker could create a new account with administrative privileges or take over existing accounts. They could then perform other administrative actions.

Q: What should be prioritized for mitigation?

Upgrade affected BSS installations to version 9.2.41. The provided information does not identify a workaround or compensating control for systems that cannot yet be upgraded.

Published Nov 10, 2026

Updated

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

Affected Software

1 affected component

AsiaInfo Business Support System (BSS)>=9.2.0<=9.2.40

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade AsiaInfo Business Support System (BSS) to a version that resolves this vulnerability.
Fixed in 9.2.41

Event History

Nov 10, 2026

CVE Published

via NVD·10:18 PM

Data Sourced

via NVD·10:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 are affected. Version 9.2.41 fixes the issue.

Does exploitation require credentials or user interaction?

No. The vulnerable management API accepts unauthenticated requests, so a remote attacker does not need an account, privileges, or user interaction.

What access could an attacker gain?

An attacker could create a new account with administrative privileges or take over existing accounts. They could then perform other administrative actions.

What should be prioritized for mitigation?

Upgrade affected BSS installations to version 9.2.41. The provided information does not identify a workaround or compensating control for systems that cannot yet be upgraded.

CVE-2026-125297: Critical severity AsiaInfo Business Support System (BSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What access could an attacker gain?

What should be prioritized for mitigation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

Does exploitation require credentials or user interaction?

What access could an attacker gain?

What should be prioritized for mitigation?