BioStar 2 API Leaks Active Directory Credentials

An API endpoint in Suprema BioStar 2 returns Active Directory service account credentials without requiring authentication. The flaw, CVE-2026-31278, affects BioStar 2 before version 2.9.12 and BioStar X before 1.0.2, and was disclosed this week via a researcher advisory. CVSS score is 7.7 (HIGH).

BioStar 2 is Suprema’s flagship physical access control platform. It handles fingerprint readers, facial recognition terminals, and RFID badge systems for building and floor access. Organizations that tie BioStar 2 to Active Directory for access policy enforcement store an AD service account’s credentials in the platform. The /api/v2/setting/adserversetting endpoint exposes those credentials to any attacker with network access to the BioStar server, authenticated or not.

The access problem

A domain service account retrieved from a physical access control system can be used the same way any other compromised credential can: to query directory services, move laterally, or attempt privilege escalation depending on what the account is permitted to do. Physical security teams typically configure these accounts with enough permissions to read group membership and validate user status, which is enough to map an organization’s users and their AD group structure from outside the normal network perimeter.

That is not a theoretical risk. It is what service accounts are for, and it is why credential exposure is the part of this CVE that matters more than the endpoint itself.

Why physical systems carry this risk

Physical access control gear operates on a different maintenance cycle than servers. Firmware and software updates come around less often. The teams responsible for door controllers and badge readers often sit in facilities or operations rather than IT, and they are not always included in the same patch management processes. A Windows server with a three-week-old unpatched vulnerability is a flag; a badge reader running outdated software for two years tends to be invisible.

When physical systems integrate with enterprise identity infrastructure, that isolation disappears. The door controller becomes a node on the network that holds domain credentials, and it receives the security scrutiny of a door controller rather than a credential store.

CISA’s own red team assessments document this pattern: physical and operational infrastructure tends to be the soft perimeter that attackers use to reach more sensitive systems. Last week’s Advantech WISE-6610 RCE disclosure shows the same axis: physical systems with network connectivity and insufficient authentication.

What to do

Suprema fixed the endpoint in BioStar 2 2.9.12 and BioStar X 1.0.2. Two steps are required.

First, upgrade to the patched version. Second, rotate the Active Directory service account credentials used for the BioStar integration. Rotating without patching leaves the endpoint open. Patching without rotating leaves any previously exfiltrated credentials valid. Both steps matter.

Organizations that cannot patch immediately should isolate the BioStar server to a management network segment and review recent authentication logs for the AD service account, looking for logon activity from unexpected hosts or at unusual hours.

The credential theft techniques used in campaigns like Storm-3121’s M365 phishing operation are a reminder that domain account access translates directly into organizational access. The initial vector varies; the downstream risk from a stolen service account does not.