Insecure Password Management in Suprema BioStar 2 Product
CVE-2025-41257

4.8MEDIUM

Key Information:

Vendor

Suprema

Status
BiOStar 2
Vendor
CVE Published:
4 March 2026

What is CVE-2025-41257?

The Suprema BioStar 2 version 2.9.11.6 contains a vulnerability that allows users to change their passwords without having to provide the current one. This flaw poses a significant risk as it can be exploited in conjunction with other vulnerabilities, facilitating unauthorized access to user accounts and potentially leading to a larger compromise of the system. It is crucial for users of BioStar 2 to be aware of this issue and take appropriate measures to secure their accounts.

Affected Version(s)

BioStar 2 2.9.11.6

References

https://github.com/sbaresearch/advisories/tree/public/202...
third-party-advisory
https://www.supremainc.com/en/platform/hybrid-security-pl...
product

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jakob Hagl (SBA Research)
Marija Radosavljević (SBA Research)
Fabian Funder (SBA Research)
.