Business Support System vulnerabilities

2 known vulnerabilities in Business Support System from AsiaInfo International. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Business Support System: Improper Verification of Cryptographic Signature

  CVE-2026-125298Nov 10, 2026AsiaInfo International

  AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privilege

• 9.8 Critical severity

  Business Support System: Missing Authentication for Critical Functionality

  CVE-2026-125297Nov 10, 2026AsiaInfo International

  AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 accepts unauthenticated requests via the management API '/bss/sysmgnt/api/'. A remote, unauthenticated attacker could provision a new account with administrative privileges or take over existing accou