Suprema BioStar 2 CVE-2026-9508

Exploitation requires that the BioStar 2 administrator has configured the backup destination path to a directory located inside the bundled NGINX webroot - this is the specific misconfiguration that makes backup ZIPs reachable via '/download/' URLs. The attacker also needs network reachability to the BioStar 2 web interface (typically TCP 80/443) and either knowledge or guessability of the backup filename under that path. No authentication, no user interaction, and no privileges are required (CVSS PR:N/UI:N), and the affected version range is BioStar 2 server 2.9.3 through 2.9.11. The main limiting factor is the non-default configuration prerequisite: installations where backups are stored outside the NGINX webroot are not exposed to this issue.

All available signals point to high real-world risk where the vulnerable configuration exists: the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N indicates remote, low-complexity, unauthenticated exploitation with no user interaction, yielding a 10.0 score, and CISA's SSVC framework concurs with Automatable: yes and Technical Impact: total. The mitigating factor is SSVC Exploitation: none - there is no public exploit identified at time of analysis and the issue is not on CISA KEV, so widespread mass exploitation has not been observed yet. EPSS data was not provided in the input and cannot be cited. The vulnerability is also conditional on a specific administrator misconfiguration (backup path inside the NGINX webroot), so the population of exploitable installations is a subset of total deployments - but for any instance that is misconfigured, exploitation is trivial and fully automatable by simply requesting predictable '/download/' URLs.

An attacker scans the internet for exposed BioStar 2 servers, then issues unauthenticated GET requests to predictable URLs under 'http(s)://[server]/download/' to enumerate and retrieve backup ZIP archives. Using credentials, certificates, and configuration extracted from the backup, the attacker authenticates to the BioStar 2 database, impersonates the server, and pivots into the surrounding corporate network to reach connected door controllers, identity stores, or HR systems. No public exploit identified at time of analysis, but the access pattern is trivial to script.