Unauthenticated Access Vulnerability in AsiaInfo Business Support System
CVE-2026-125297

9.3CRITICAL

Key Information:

Vendor

Asiainfo International

Status
Business Support System
Aether-menu
Vendor
CVE Published:
10 November 2026

What is CVE-2026-125297?

The AsiaInfo Business Support System (BSS) versions 9.2.0 to 9.2.40 contains a vulnerability that allows unauthenticated attackers to send requests to the management API at '/bss/sysmgnt/api/'. This security flaw can enable unauthorized users to create new accounts with administrative privileges or hijack existing accounts. Additionally, the attacker can perform a range of administrative actions without proper authentication. Users are strongly advised to upgrade to version 9.2.41 or higher to mitigate this risk.

Affected Version(s)

aether-menu 2.2.1 < 2.2.7

Business Support System 9.2.0 < 9.2.41

aether-menu 2.2.7

References

https://www.asiainfo.eu/cloudbss
product
https://github.com/trevorkaon/vulnerability-security-rese...
third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2026-125297
vdb-entry

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Trevor Kaon, security researcher (ORCID 0009-0007-0562-1331)
.