CVE-2026-9509
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
An unhandled exception in Suprema BioStar 2 (Server) versions 2.9.8, 2.9.10, and 2.9.11 allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending HTTP POST requests to the '/api/migration' endpoint. This triggers a failure that halts critical processes, leaving the system offline until manual restart of services or the server.
Risk Assessment
The risk for the organization includes complete loss of availability of the access control system, potentially disabling readers and disrupting third-party integrations. The exploit requires no privileges or user interaction and is trivial to automate, increasing the likelihood of exploitation.
Recommendation
It is recommended to immediately update Suprema BioStar 2 to a version containing a fix for this vulnerability. Until an update is applied, restrict access to the '/api/migration' endpoint using firewall rules or access control lists.
Other vulnerabilities in Suprema BioStar 2
See all- CVE-2026-9508Critical
A vulnerability in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) stems from incorrect permission settings on a critical resource, causing backup files to be publicly exposed when the administrator configures their path within the NGINX webroot. An attacker with network access can directly download backup ZIP files via ‘http(s)://[server]/download/…’ without authentication.
- CVE-2023-27167Medium
Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the 'values' parameter at /users/absence?search_month=1. An attacker can exploit this flaw to manipulate database queries.
- CVE-2023-33366High
A SQL injection vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing authenticated users to inject arbitrary SQL directives into SQL statements and execute arbitrary SQL commands.
- CVE-2023-33365High
A path traversal vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated attackers to fetch arbitrary files from the server.
- CVE-2023-33364High
An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS commands on the BioStar 2 server.
- CVE-2023-33363High
An authentication bypass vulnerability exists in Suprema BioStar 2 before version 2.9.1, allowing unauthenticated users to access some functionality on BioStar 2 servers.
Original NVD description (English source)
An unhandled exception in Suprema BioStar 2 (Server), versions 2.9.8, 2.9.10, and 2.9.11, that allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending HTTP POST requests to the ‘/api/migration’ endpoint. This request triggers a failure that halts critical processes, leaving the system offline until the services or server are manually restarted. As a result, access control readers cease to function, and potential failures may occur in third-party integrations. Since the exploit requires no privileges or user interaction and is trivial to automate, the impact on availability is high, and the effect extends to interconnected systems.