Description
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accounts, and perform other administrative actions. Fixed in 9.2.41.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| AsiaInfo International | Business Support System | 9.2.0 – < 9.2.41 | 9.2.41 |
| AsiaInfo International | aether-menu | 2.2.1 – < 2.2.7 | 2.2.7 |
Advisories 1
- VA-26-313-03 AsiaInfo BSS multiple vulnerabilities CISA ICS & IT advisories · Nov 10, 2026