This vulnerability (CWE-732) arises from improper permission settings on critical backup files in Suprema BioStar 2 server versions 2.9.3 through 2.9.11. When administrators configure backup file paths inside the NGINX webroot, these files become directly downloadable over HTTP(S) without requiring authentication. This exposure allows attackers with network access to obtain sensitive backup data, potentially enabling server impersonation, unauthorized database access, and lateral movement. The vulnerability is remotely exploitable without privileges or user interaction and is rated critical with a CVSS 4.0 score of 10. No patch or official remediation level has been published yet.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive backup files containing critical information. This can facilitate server impersonation, unauthorized access to backend databases, and lateral movement within the affected environment. The vulnerability is remotely exploitable without authentication, increasing the risk of compromise. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should avoid configuring backup file paths within the NGINX webroot or restrict access to these backup files through web server configuration to prevent unauthorized downloads.