CVE-2025-41257CWE-20

Suprema BioStar 2 Insecure Password Change

Medium · published March 4, 2026

CVSS v3.1
4.8
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-04T22:43Z
EPSS history
Timeline
  • 04 MAR 22:43Z
    Suprema BioStar 2 Insecure Password Change
    cvelistv5