CVE-2025-41257

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.

Score

CVSS 3.1 4.8 Medium

Status

Awaiting Analysis - 1e3a9e0f-5156-4bf8-b8a3-cc311bfc0f4a

Published

2026-03-04

Last modified

2026-03-09

Weaknesses

CWE-20

Affected products

• Biostar 2 (Suprema)

References

• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Chan…
• https://www.supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp