The vulnerability CVE-2026-31278 involves cleartext transmission of sensitive information (Active Directory service account credentials) through the /api/v2/setting/adserversetting endpoint in Suprema BioStar 2 prior to version 2.9.12 and BioStar X prior to 1.0.2. An attacker with low privileges can send a crafted GET request to obtain these credentials in cleartext, potentially compromising Active Directory authentication. The CVSS v3.1 score is 7.7, indicating high severity, with network attack vector, low attack complexity, and no user interaction required. The impact is confidentiality loss without integrity or availability impact.

An attacker with low privileges can obtain Active Directory service account credentials in cleartext, leading to a high confidentiality impact. This could facilitate further unauthorized access or lateral movement within the affected environment. There is no reported impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint and monitor for suspicious GET requests targeting /api/v2/setting/adserversetting. Avoid exposing the service to untrusted networks.