CVE-2025-41257 Suprema BioStar 2 Insecure Password Change
Attackers can change user passwords without knowing the current one, leading to unauthorized account access and potential system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-41257?
CVE-2025-41257 is a medium-severity authentication bypass vulnerability in Suprema BioStar 2, published on 4 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Suprema’s BioStar 2 in version 2.9.11.6 allows users to set new password without providing the current one. Exploiting this flaw combined with other vulnerabilities can lead to unauthorized account access and potential system compromise.
Weakness: CWE-20
Which versions are affected by CVE-2025-41257?
How do I fix CVE-2025-41257?
No fix has been published for CVE-2025-41257 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-41257 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-41257 exists.
Sources
Also known as GHSA-jj36-c637-m3x8.