Critical severity9.8NVD Advisory· Published Nov 10, 2026

CVE-2026-125297

Description

AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.

Affected products

AsiaInfo/Business Support Systemllm-create
Range: 9.2.0 through 9.2.40
AsiaInfo/BSSllm-create
Range: 9.2.0 through 9.2.40

Patches

Vulnerability mechanics

References

github.com/trevorkaon/vulnerability-security-research/blob/main/advisories/asiainfo/CVE-2026-125297.mdnvd
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-313-03.jsonnvd
www.asiainfo.eu/cloudbssnvd
www.cve.org/CVERecordnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000