Active Directory Credential Exposure in Suprema BioStar

Executive Summary

CVE-2026-31278 is a vulnerability in Suprema BioStar 2 and BioStar X systems where an attacker can retrieve Active Directory service account credentials in plaintext by sending a crafted GET request to the /api/v2/setting/adserversetting endpoint. The credentials are exposed despite being masked in the admin UI, allowing unauthorized LDAP authentication against Active Directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your BioStar 2 or BioStar X system is running a vulnerable version (BioStar 2 before 2.9.12 or BioStar X before 1.0.2). Use network monitoring tools to inspect GET requests to the /api/v2/setting/adserversetting endpoint for plaintext Active Directory credentials. Verify if the API response includes unencrypted passwords despite the UI masking them.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to obtain Active Directory credentials, enabling LDAP authentication. This can lead to domain user enumeration, internal network reconnaissance, lateral movement within the network, and potential privilege escalation depending on the service account permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability exposes Active Directory service account credentials in cleartext, which could lead to unauthorized access to sensitive systems and data. For GDPR, this may violate principles of data protection by design and default, as well as requirements for confidentiality and integrity of personal data. Under HIPAA, it could compromise protected health information if the system is used in healthcare settings, potentially violating security rule requirements for access controls and transmission security.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update BioStar 2 to version 2.9.12 or later and BioStar X to version 1.0.2 or later. Rotate all Active Directory service account credentials. Restrict API access to trusted network segments and enable LDAPS (SSL) for Active Directory communication to prevent credential exposure.

Useful 0 Not Useful 0