Aether-Menu (< 2.2.7) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/aether-menu--2.2.7/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:03:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAsiaInfo Business Support System (BSS) multiple vulnerabilities (CVE-2026-125297, CVE-2026-125298)https://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-vulns/Thu, 12 Nov 2026 14:03:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-asiainfo-bss-vulns/AsiaInfo Business Support System (BSS) contains critical vulnerabilities including missing authentication and improper JWT signature verification, allowing remote unauthenticated attackers to hijack accounts and execute administrative actions.AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 contain critical vulnerabilities that enable unauthenticated remote attackers to bypass authentication mechanisms and execute administrative actions. The vulnerabilities include missing authentication for the management API and failure to verify cryptographic signatures for JSON Web Tokens (JWT). These flaws allow attackers to provision new administrative accounts or take over existing ones. These issues are addressed in BSS version 9.2.41 and aether-menu version 2.2.7.

Impact

Successful exploitation allows remote, unauthenticated attackers to gain unauthorized administrative access to the BSS platform, potentially leading to full system compromise, account takeover, and unauthorized administrative configuration changes.

Recommendation

  • Upgrade AsiaInfo Business Support System (BSS) to version 9.2.41 or later immediately.
  • Ensure the updated aether-menu version 2.2.7 is deployed with the BSS update.
  • Audit existing user accounts and API configurations within BSS for unauthorized changes created prior to the update.
  • Implement strict network access controls to limit exposure of the /bss/sysmgnt/api/ endpoint to only trusted administrative workstations.
]]>mediumadvisory