Skip to content
OpenAdvisories
Critical VA-26-313-03 2 CVEs

AsiaInfo BSS multiple vulnerabilities

Published Nov 10, 2026 · Updated Nov 10, 2026

Vendor: AsiaInfo International Product: aether-menu Product: Business Support System

Summary

AsiaInfo Business Support System (BSS) contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions.

Vulnerabilities 2

  • Critical 9.8
    CVE-2026-125297

    AsiaInfo Business Support System (BSS) Missing Authentication

    AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing acco…

    AsiaInfo International aether-menu Business Support System
  • Critical 9.8
    CVE-2026-125298

    AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

    AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileg…

    AsiaInfo International Business Support System aether-menu

Revision history

  1. #1.0.0

    Initial publication