CVE-2026-9508: Incorrect Permission Assignment for Critical Resource vulnerability in Suprema's BioStar

Synopsis

An incorrect permission assignment in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) exposes administrator-configured backup ZIP files through the NGINX webroot, letting any unauthenticated network user download them directly from a predictable /download/ URL. Successful exploitation hands the attacker sensitive backup contents that enable server impersonation, database access, and lateral movement into connected systems. A patched-image rebuild at v2.9.12 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the BioStar 2 web server over the network on its HTTP(S) port (AV:N).

• AuthenticationNot required

  No credentials are needed; the backup files are served directly from the NGINX webroot (PR:N).

• Victim interactionNot required

  The attacker fetches the backup URL on their own; no administrator or user action is involved (UI:N).

• Attack complexityDetail

  AC:L: the exploit is a single unauthenticated HTTP GET against a predictable /download/ path with no race or environmental conditions.

Blast Radius

• Reads the contents of administrator backup ZIP archives, including configuration and database material.
• Recovers credentials and keys from the backups that enable impersonation of the BioStar server to clients and devices.
• Uses extracted database contents and secrets to access connected systems and pivot laterally inside the network.