CVE-2026-9508
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) stems from incorrect permission settings on a critical resource, causing backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. An attacker with network access can directly download backup ZIP files via ‘http(s)://[server]/download/…’ without authentication.
Risk Assessment
The risk for the organization includes exposure of highly sensitive information, which can lead to server impersonation, unauthorized access to databases, and lateral movement within the network.
Recommendation
It is recommended to immediately update Suprema BioStar 2 to version 2.9.12 or later, and to review and correct the NGINX configuration to ensure backup files are not publicly accessible.
Other vulnerabilities in Suprema BioStar 2
See all- CVE-2023-27167Medium
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.
- CVE-2026-31278High
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.
- CVE-2026-9509High
An unhandled exception in Suprema BioStar 2 (Server) versions 2.9.8, 2.9.10, and 2.9.11 allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending HTTP POST requests to the '/api/migration' endpoint. This triggers a failure that halts critical processes, leaving the system offline until manual restart of services or the server.
- CVE-2023-33366High
A SQL injection vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing authenticated users to inject arbitrary SQL directives into SQL statements and execute arbitrary SQL commands.
- CVE-2023-33365High
A path traversal vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated attackers to fetch arbitrary files from the server.
- CVE-2023-33364High
An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.
- CVE-2023-33363High
An authentication bypass vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated users to access some functionality on BioStar 2 servers.
Original NVD description (English source)
Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. This vulnerability allows an attacker with network access to directly download backup ZIP files via ‘http(s)://[server]/download/…’ without requiring authentication. This exposes highly sensitive information that can lead to server impersonation, unauthorized access to databases, and lateral movement.