AsiaInfo Business Support System (BSS) versions 9.2.0 through 9.2.40 have a critical vulnerability that allows unauthenticated remote attackers to send requests via the management API '/bss/sysmgnt/api/'. This flaw enables attackers to provision new administrative accounts or take over existing ones, leading to full administrative control. The vulnerability is fixed in version 9.2.41.