CVE-2025-41257

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-41257", "assignerOrgId": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "state": "PUBLISHED", "assignerShortName": "sba-research", "dateReserved": "2025-04-16T09:37:50.631Z", "datePublished": "2026-03-04T22:43:53.077Z", "dateUpdated": "2026-03-09T20:59:30.756Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "BioStar 2", "vendor": "Suprema", "versions": [{"status": "affected", "version": "2.9.11.6"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jakob Hagl (SBA Research)"}, {"lang": "en", "type": "finder", "value": "Marija Radosavljevi\u0107 (SBA Research)"}, {"lang": "en", "type": "finder", "value": "Fabian Funder (SBA Research)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div>Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.</div></div>"}], "value": "Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "description": "CWE-20 Improper Input Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "shortName": "sba-research", "dateUpdated": "2026-03-04T22:43:53.077Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change"}, {"tags": ["product"], "url": "https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp"}], "source": {"discovery": "UNKNOWN"}, "title": "Suprema BioStar 2 Insecure Password Change", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"references": [{"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T20:59:23.621480Z", "id": "CVE-2025-41257", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:59:30.756Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41257", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-09T20:59:23.621480Z"}}}], "references": [{"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T20:59:19.397Z"}}], "cna": {"title": "Suprema BioStar 2 Insecure Password Change", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Jakob Hagl (SBA Research)"}, {"lang": "en", "type": "finder", "value": "Marija Radosavljevi\u0107 (SBA Research)"}, {"lang": "en", "type": "finder", "value": "Fabian Funder (SBA Research)"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Suprema", "product": "BioStar 2", "versions": [{"status": "affected", "version": "2.9.11.6"}], "defaultStatus": "unknown"}], "references": [{"url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change", "tags": ["third-party-advisory"]}, {"url": "https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.", "supportingMedia": [{"type": "text/html", "value": "<div><div>Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.</div></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "shortName": "sba-research", "dateUpdated": "2026-03-04T22:43:53.077Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41257", "state": "PUBLISHED", "dateUpdated": "2026-03-09T20:59:30.756Z", "dateReserved": "2025-04-16T09:37:50.631Z", "assignerOrgId": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "datePublished": "2026-03-04T22:43:53.077Z", "assignerShortName": "sba-research"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "BioStar 2", "vendor": "Suprema", "versions": [{"status": "affected", "version": "2.9.11.6"}]}], "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Suprema\u2019s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise."}, {"lang": "es", "value": "BioStar 2 de Suprema en la versi\u00f3n 2.9.11.6 permite a los usuarios establecer una nueva contrase\u00f1a sin proporcionar la actual. Explotar esta falla combinado con otras vulnerabilidades puede llevar a un acceso no autorizado a la cuenta y un posible compromiso del sistema."}], "id": "CVE-2025-41257", "lastModified": "2026-06-17T09:22:41.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41257", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T20:59:23.621480Z", "version": "2.0.3"}}]}, "published": "2026-03-04T23:16:09.713", "references": [{"source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change"}, {"source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "url": "https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change"}], "sourceIdentifier": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "2.9.11.6"}}], "enrichment": {"confidence": 92.0, "confidence_source": "matching", "scores": [{"score": 92.0, "source": "matching"}]}, "original": {"product": "BioStar 2", "source": "cna", "vendor": "Suprema"}, "product": "biostar_2", "vendor": "supremainc"}], "created": "2026-03-05T09:05:33.833739+00:00", "updated": "2026-03-05T09:05:33.833822+00:00", "vendors": ["supremainc", "supremainc$PRODUCT$biostar_2"]}