CVE-2025-41257

Published: Mar 4, 2026Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Exploitability: 2.2 / Impact: 2.5

Source: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a (Secondary)

Description

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change

Source: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a

https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp

Source: 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a

https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.