CVE-2026-125297 · Vendor
NO FIX YET · SEE WHAT TO DO
AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 accept requests to the management API path /bss/sysmgnt/api/ without authentication. A remote attacker can create an account with administrative privileges or take over existing accounts.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Operators of AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 whose management API is reachable over the network. The sources do not describe further configuration conditions, so any exposed instance in that range should be treated as affected. Operators already on 9.2.41 or later are not affected by this flaw.
Not affected if version-9.2.41-or-later
Who cares asiainfo, bss, telecom
/bss/sysmgnt/api/ from outside the trusted network (unknown exact check from the sources)9.2.41AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.