PT-2026-23078 · Suprema · Biostar 2

Fabian Funder + 2 · Published 2026-03-04 · Updated 2026-03-09 · CVE-2025-41257

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Suprema BioStar 2 version 2.9.11.6

Description BioStar 2 version 2.9.11.6 allows users to set a new password without providing the current password. Exploiting this flaw, in combination with other vulnerabilities, can lead to unauthorized account access and potential system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-41257

Affected Products

Biostar 2

References · 8

• 🔥 https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20251104-02_Suprema_BioStar_2_Insecure_Password_Change · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-41257 · Security Note
• https://t.me/cveNotify/154885 · Telegram Post
• https://t.me/CVEtracker/46381 · Telegram Post
• https://t.me/cveNotify/154232 · Telegram Post
• https://twitter.com/infoflowcloud/status/2029339953960771740 · Twitter Post
• https://supremainc.com/en/platform/hybrid-security-platform-biostar-2.asp · Note
• https://twitter.com/CVEnew/status/2029339222537322761 · Twitter Post