CVE-2026-125297

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges, take over existing accounts, or perform other administrative actions. Fixed in version 9.2.41.

An attacker could gain full administrative control over the BSS without authentication, leading to account takeover and unauthorized configuration changes. System integrity and availability are at risk.

Update AsiaInfo BSS to version 9.2.41 or later. Restrict network access to the '/bss/sysmgnt/api/' endpoint and review logs for unauthorized requests.