CVE-2020-15050: Suprema BioStar 2 video extension directory traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated remote arbitrary file read with a high EPSS score and a public exploit reference, though no KEV listing or confirmed in-the-wild campaign.

What it is

The Video Extension in Suprema BioStar 2 before 2.8.2 is vulnerable to directory traversal, allowing remote attackers to read arbitrary files from the server. Because BioStar 2 is an access control and biometrics platform, exposed file contents could include configuration or credential material that undermines physical security systems.

Impact

An unauthenticated remote attacker can read arbitrary files on the server, exposing sensitive configuration, credential or system data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable over the network through the Video Extension component with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not specify the exact endpoint or parameter used.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.51 probability (98.9th percentile), and a public exploit reference exists on Packet Storm, indicating meaningful real-world exploitation likelihood.

What to do

• Upgrade BioStar 2 to version 2.8.2 or later, which the vendor advisory covers.
• If immediate upgrade is not possible, restrict network access to the BioStar 2 server and its Video Extension to trusted management networks only.
• Run the BioStar 2 service with least privilege and avoid storing plaintext credentials or secrets on the same host.
• Monitor the vendor advisory page for further guidance and confirm the deployed version.
• Review firewall and reverse proxy rules to block untrusted access to the web interface.

Detection

• Inspect web server and application logs for traversal sequences such as ../ or encoded variants in requests to BioStar 2 endpoints.
• Alert on requests to the Video Extension paths from unexpected or external source IP addresses.
• Monitor for unusual file read activity by the BioStar 2 process outside its expected directories.
• Baseline normal BioStar 2 request patterns and flag deviations in URI structure or file path parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.