{"id":"CVE-2026-125297","kind":"vulnerability","aliases":["CVE-2026-125297"],"related":[],"title":"AsiaInfo BSS: management API lets unauthenticated attackers create admin accounts","description":"AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.","summary":"AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 accept requests to the management API path /bss/sysmgnt/api/ without authentication. A remote attacker can create an account with administrative privileges or take over existing accounts.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["asiainfo","bss","telecom","vendor"],"not_affected_if":["version-9.2.41-or-later"],"how_to_check":"- Check whether the BSS deployment runs a version from 9.2.0 through 9.2.40 (unknown how the sources expect this to be read from the product itself)\n- Look for reachable requests to `/bss/sysmgnt/api/` from outside the trusted network (unknown exact check from the sources)","fix":"- AsiaInfo BSS: `9.2.41`","status":"open","published_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","triaged_at":"2026-11-10T22:28:42+00:00","updated_at":"2026-11-10T22:28:42+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-10T22:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- AsiaInfo BSS: `9.2.41`","reach":"internet","title":"AsiaInfo BSS: management API lets unauthenticated attackers create admin accounts","impact":"high","summary":"AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 accept requests to the management API path /bss/sysmgnt/api/ without authentication. A remote attacker can create an account with administrative privileges or take over existing accounts.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["asiainfo","bss","telecom"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker gains administrator rights and takes over accounts","analyst_note":"Confirm how to check the installed BSS version and whether the management API is exposed by default, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-125297 or the vendor advisory.","how_to_check":"- Check whether the BSS deployment runs a version from 9.2.0 through 9.2.40 (unknown how the sources expect this to be read from the product itself)\n- Look for reachable requests to `/bss/sysmgnt/api/` from outside the trusted network (unknown exact check from the sources)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-9.2.41-or-later"],"who_is_affected":"Operators of AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 whose management API is reachable over the network. The sources do not describe further configuration conditions, so any exposed instance in that range should be treated as affected. Operators already on 9.2.41 or later are not affected by this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000787,"input_tokens":4584,"output_tokens":657,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125297':13A,16A '-2026':12A,15A '/bss/sysmgnt/api':37B,70C '9.2.0':27B,60C '9.2.40':29B,62C '9.2.41':95C 'accept':30B,63C 'account':10A,46B,54B,79C,87C 'action':92C 'admin':9A 'administr':48B,81C,91C 'api':4A,35B,69C 'asiainfo':1A,17B,21B,55C 'attack':7A,42B,74C 'authent':39B 'bss':2A,18B,25B,59C 'busi':22B,56C 'could':75C 'creat':8A,44B 'cve':11A,14A 'exist':53B,86C 'fix':93C 'let':5A 'manag':3A,34B,68C 'new':78C 'path':36B 'perform':89C 'privileg':49B,82C 'provis':76C 'remot':41B,72C 'request':31B,65C 'support':23B,57C 'system':24B,58C 'take':51B,84C 'telecom':19B 'unauthent':6A,64C,73C 'vendor':20B 'version':26B 'via':66C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Operators of AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 whose management API is reachable over the network. The sources do not describe further configuration conditions, so any exposed instance in that range should be treated as affected. Operators already on 9.2.41 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["asiainfo","bss","critical","telecom","vendor"],"campaign_type":null,"search_a":"'-125297':13A,16A '-2026':12A,15A 'account':10A 'admin':9A 'api':4A 'asiainfo':1A 'attack':7A 'bss':2A 'creat':8A 'cve':11A,14A 'let':5A 'manag':3A 'unauthent':6A","search_b":"'/bss/sysmgnt/api':37B '9.2.0':27B '9.2.40':29B 'accept':30B 'account':46B,54B 'administr':48B 'api':35B 'asiainfo':17B,21B 'attack':42B 'authent':39B 'bss':18B,25B 'busi':22B 'creat':44B 'exist':53B 'manag':34B 'path':36B 'privileg':49B 'remot':41B 'request':31B 'support':23B 'system':24B 'take':51B 'telecom':19B 'vendor':20B 'version':26B 'without':38B","search_c":"'/bss/sysmgnt/api':70C '9.2.0':60C '9.2.40':62C '9.2.41':95C 'accept':63C 'account':79C,87C 'action':92C 'administr':81C,91C 'api':69C 'asiainfo':55C 'attack':74C 'bss':59C 'busi':56C 'could':75C 'exist':86C 'fix':93C 'manag':68C 'new':78C 'perform':89C 'privileg':82C 'provis':76C 'remot':72C 'request':65C 'support':57C 'system':58C 'take':84C 'unauthent':64C,73C 'via':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:18:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"9119a7d8-5eab-497f-8521-727c672e3725","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125297","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125297","severity":null,"published_at":"2026-11-10T22:18:30+00:00","modified_at":"2026-11-10T22:18:30+00:00","first_seen_at":"2026-11-10T22:27:29+00:00","fetched_at":"2026-11-10T22:27:29+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}