medium advisory November 12, 2026

AsiaInfo Business Support System (BSS) multiple vulnerabilities (CVE-2026-125297, CVE-2026-125298)

AsiaInfo Business Support System (BSS) contains critical vulnerabilities including missing authentication and improper JWT signature verification, allowing remote unauthenticated attackers to hijack accounts and execute administrative actions.

Triage facts

Revision 1

Applicability: Business Support System (BSS) (9.2.0 - 9.2.40), aether-menu (< 2.2.7)
Evidence: Unknown
Severity: Medium
Action: Immediate escalation
Sources: 1 public source
Freshness: Revision 1Nov 12, 14:03 UTC
Detection: 1 rule
Vulnerabilities: 2 CVEs
Source quality: A1Very likely

AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 contain critical vulnerabilities that enable unauthenticated remote attackers to bypass authentication mechanisms and execute administrative actions. The vulnerabilities include missing authentication for the management API and failure to verify cryptographic signatures for JSON Web Tokens (JWT). These flaws allow attackers to provision new administrative accounts or take over existing ones. These issues are addressed in BSS version 9.2.41 and aether-menu version 2.2.7.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain unauthorized administrative access to the BSS platform, potentially leading to full system compromise, account takeover, and unauthorized administrative configuration changes.

Recommendation

Upgrade AsiaInfo Business Support System (BSS) to version 9.2.41 or later immediately.
Ensure the updated aether-menu version 2.2.7 is deployed with the BSS update.
Audit existing user accounts and API configurations within BSS for unauthorized changes created prior to the update.
Implement strict network access controls to limit exposure of the /bss/sysmgnt/api/ endpoint to only trusted administrative workstations.

Immediate actions

Upgrade AsiaInfo BSS to version 9.2.41 and aether-menu to 2.2.7

IT Operations 48h

Threat Hunt

Identify successful logins or administrative account creation requests originating from unknown or non-administrative IP addresses targeting the /bss/sysmgnt/api/ endpoint.

T1190 high medium confidence hunt now

Data: Web server access logs, Application audit logs for BSS

Mitigations

Upgrade to AsiaInfo BSS version 9.2.41

immediate IT Operations

CVE-2026-125297, CVE-2026-125298

Detection coverage 1

Detect CVE-2026-125297 Exploitation - Unauthorized Access to BSS API

high

Detects unauthenticated requests to the management API /bss/sysmgnt/api/ which is vulnerable to missing authentication per CVE-2026-125297.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detection queries are available on the platform. Get full rules →