Suprema BioStar 2 API Exposes Active Directory Credentials
An unauthenticated attacker can query the /api/v2/setting/adserversetting endpoint in Suprema BioStar 2 before 2.9.12 and BioStar X before 1.0.2 to retrieve Active Directory service account credentials, enabling potential lateral movement.
- Vendor
- Suprema
- Product
- BioStar 2, BioStar X
- CVSS
- 7.7
- EPSS (exploit probability)
- 0.3%
- Status
- patched
- Published
Is CVE-2026-31278 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-31278 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-05 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.3% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-31278 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
Suprema BioStar 2 is a physical access control platform deployed for fingerprint, face recognition, and RFID badge management in enterprise facilities. When configured with Active Directory integration, BioStar 2 stores a domain service account credential set used to authenticate against AD. CVE-2026-31278 exposes those credentials through the /api/v2/setting/adserversetting API endpoint without requiring authentication.
Any attacker with network access to the BioStar 2 server can query the endpoint and retrieve the stored AD credentials. Depending on the permissions of that service account, an attacker may be able to enumerate directory objects, validate user accounts, or use the credentials to move laterally into domain-joined systems.
Affected versions: BioStar 2 through 2.9.11; BioStar X through 1.0.1.
Fix: Upgrade to BioStar 2 2.9.12 or BioStar X 1.0.2. After patching, rotate the Active Directory service account credentials used for the integration. A patch without credential rotation leaves any previously exfiltrated credentials valid.
References:
