CVE-2025-41257

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change
https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp
https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change

Configurations

No configuration.

History

17 Jun 2026, 09:22

Type	Values Removed	Values Added
Summary		(es) BioStar 2 de Suprema en la versión 2.9.11.6 permite a los usuarios establecer una nueva contraseña sin proporcionar la actual. Explotar esta falla combinado con otras vulnerabilidades puede llevar a un acceso no autorizado a la cuenta y un posible compromiso del sistema.

09 Mar 2026, 21:16

Type	Values Removed	Values Added
References	~~() https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change -~~	() https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change -

04 Mar 2026, 23:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-04 23:16

Updated : 2026-06-17 09:22

NVD link : CVE-2025-41257

Mitre link : CVE-2025-41257

CVE.ORG link : CVE-2025-41257

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-41257", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41257", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:59:23.621480Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.2}]}, "affected": [{"source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "affectedData": [{"vendor": "Suprema", "product": "BioStar 2", "versions": [{"status": "affected", "version": "2.9.11.6"}], "defaultStatus": "unknown"}]}], "published": "2026-03-04T23:16:09.713", "references": [{"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change", "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a"}, {"url": "https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp", "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a"}, {"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise."}, {"lang": "es", "value": "BioStar 2 de Suprema en la versi\u00f3n 2.9.11.6 permite a los usuarios establecer una nueva contrase\u00f1a sin proporcionar la actual. Explotar esta falla combinado con otras vulnerabilidades puede llevar a un acceso no autorizado a la cuenta y un posible compromiso del sistema."}], "lastModified": "2026-06-17T09:22:41.130", "sourceIdentifier": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a"}