Denial of Service Vulnerability in Suprema BioStar 2 by Suprema

CVE-2026-9509

What is CVE-2026-9509?

An unhandled exception in Suprema BioStar 2, specifically in versions 2.9.8 through 2.9.11, can allow unauthenticated remote attackers to disrupt service. By sending specially crafted HTTP POST requests to the '/api/migration' endpoint, attackers can trigger a failure that brings down essential processes, effectively making the system inoperative until a manual restart is performed. The unavailability of access control readers can lead to significant operational disruptions and may impact third-party system integrations. Given the ease of automation for this exploit and the lack of authentication requirements, the availability of interconnected systems may also be considerably compromised.

References