Suprema BioStar 2 API Exposes Active Directory Credentials
An unauthenticated attacker can query the /api/v2/setting/adserversetting endpoint in Suprema BioStar 2 before 2.9.12 and BioStar X before 1.0.2 to retrieve Active Directory service account credentials, enabling potential lateral movement.
- Vendor
- Suprema
- Product
- BioStar 2, BioStar X
- CVSS
- 7.7
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Suprema BioStar 2 is a physical access control platform deployed for fingerprint, face recognition, and RFID badge management in enterprise facilities. When configured with Active Directory integration, BioStar 2 stores a domain service account credential set used to authenticate against AD. CVE-2026-31278 exposes those credentials through the /api/v2/setting/adserversetting API endpoint without requiring authentication.
Any attacker with network access to the BioStar 2 server can query the endpoint and retrieve the stored AD credentials. Depending on the permissions of that service account, an attacker may be able to enumerate directory objects, validate user accounts, or use the credentials to move laterally into domain-joined systems.
Affected versions: BioStar 2 through 2.9.11; BioStar X through 1.0.1.
Fix: Upgrade to BioStar 2 2.9.12 or BioStar X 1.0.2. After patching, rotate the Active Directory service account credentials used for the integration. A patch without credential rotation leaves any previously exfiltrated credentials valid.
References:
