CVE-2026-125297
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Nov 10, 2026
Vendor
unknown
Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.