AsiaInfo Business Support System: Missing JWT signature verification
Summary
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify the cryptographic signatures of JSON Web Tokens (JWT). A remote, unauthenticated attacker can forge a well-formed JWT without a valid signature and use it to execute privileged actions. The researcher showed that on affected builds a forged token passes authentication, but a privileged action was not demonstrated on a live system. Relevance is limited to organisations that operate AsiaInfo BSS, typically telecom operators and service providers.
Affected
- AsiaInfo Business Support System (BSS) 9.2.0 to 9.2.40
- Component aether-menu 2.2.1 to 2.2.6 (scope to be confirmed with the vendor, as the CVE description names only the BSS)
Fixed in
- Business Support System 9.2.41
- aether-menu 2.2.7 (shipped in 9.2.41)
Workaround
Unknown.
Exploitation
- Not known to be exploited (aggregator information, not verified against CISA KEV).
- No public proof of concept or exploit code found in the sources reviewed.
Our recommendation
- Ask whether AsiaInfo BSS or aether-menu is in use. If not, no action is needed.
- If in use, confirm the installed version and upgrade to 9.2.41 (aether-menu 2.2.7) as a priority.
- Check whether the management API and subscriber interfaces are reachable from the internet and restrict access.
- Review access logs for unexpected administrative accounts or sessions.
- Assess CVE-2026-125297 (unauthenticated management API) together with this issue.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125298 www.cve.org
- Researcher advisory CVE-2026-125298 github.com
- CISA CSAF advisory va-26-313-03 raw.githubusercontent.com
- AsiaInfo CloudBSS product page www.asiainfo.eu
- OffSeq radar CVE-2026-125298 radar.offseq.com
- Strix CVE-2026-125298 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 23:36.
Original description (NVD)
AsiaInfo Business Support System (BSS) 9.2.0 through 9.2.40 does not correctly verify cryptographic signatures for JSON Web Tokens (JWT). A remote, unauthenticated attacker could forge a well-formed JWT without a valid signature and use it to execute privileged actions. Fixed in 9.2.41.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.