HIGH

CVE-2026-31278

2026-09-14 CVSS v3.1

CVSS

7.7

Description

An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers to obtain Active Directory service account credentials in cleartext by supplying a crafted GET request.

Weakness (CWE)

CWE-319 Cleartext Transmission

EPSS Score

0.17%

Probability of exploitation in next 30 days

6.4th percentile

References

https://github.com/mda1r/biostar2-ad-credential-exposure https://www.supremainc.com https://github.com/mda1r/CVE-2026-31278

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE