{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/aether-menu--2.2.7/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-125297"},{"cvss":9.8,"id":"CVE-2026-125298"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Business Support System (BSS) (9.2.0 - 9.2.40)","aether-menu (\u003c 2.2.7)"],"_cs_severities":["medium"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["AsiaInfo"],"content_html":"\u003cp\u003eAsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 contain critical vulnerabilities that enable unauthenticated remote attackers to bypass authentication mechanisms and execute administrative actions. The vulnerabilities include missing authentication for the management API and failure to verify cryptographic signatures for JSON Web Tokens (JWT). These flaws allow attackers to provision new administrative accounts or take over existing ones. These issues are addressed in BSS version 9.2.41 and aether-menu version 2.2.7.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows remote, unauthenticated attackers to gain unauthorized administrative access to the BSS platform, potentially leading to full system compromise, account takeover, and unauthorized administrative configuration changes.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade AsiaInfo Business Support System (BSS) to version 9.2.41 or later immediately.\u003c/li\u003e\n\u003cli\u003eEnsure the updated aether-menu version 2.2.7 is deployed with the BSS update.\u003c/li\u003e\n\u003cli\u003eAudit existing user accounts and API configurations within BSS for unauthorized changes created prior to the update.\u003c/li\u003e\n\u003cli\u003eImplement strict network access controls to limit exposure of the /bss/sysmgnt/api/ endpoint to only trusted administrative workstations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T14:03:36Z","date_published":"2026-11-12T14:03:36Z","id":"https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-vulns/","summary":"AsiaInfo Business Support System (BSS) contains critical vulnerabilities including missing authentication and improper JWT signature verification, allowing remote unauthenticated attackers to hijack accounts and execute administrative actions.","title":"AsiaInfo Business Support System (BSS) multiple vulnerabilities (CVE-2026-125297, CVE-2026-125298)","url":"https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-vulns/"}],"language":"en","title":"CraftedSignal Threat Feed - Aether-Menu (\u003c 2.2.7)","version":"https://jsonfeed.org/version/1.1"}