CVE-2020-15050

What it actually does

The flaw allows unauthenticated remote attackers to supply directory traversal sequences in requests to the Video Extension, bypassing path restrictions and reading arbitrary files from the server filesystem.

Why it matters to the business

Attackers can obtain sensitive configuration files, credentials, or operational data from access-control servers, leading to unauthorized physical access, data breaches, and disruption of security operations; high EPSS and weaponized exploit maturity increase urgency for any organization running the affected product.

How an attack unfolds

An attacker locates the exposed Video Extension endpoint, crafts HTTP requests containing sequences such as ../ or ..%2f to escape the web root, and retrieves files such as configuration or database contents; the weaponized nature of the flaw enables automated or scripted exploitation without authentication.

How to fix it

Upgrade all instances of Suprema BioStar 2 to version 2.8.2 or later; restrict network exposure of the Video Extension component until the upgrade is complete.

How to confirm the fix worked

Confirm the installed version is 2.8.2 or newer; attempt known traversal sequences against the Video Extension and verify that requests are rejected or sanitized.

Typical attack path

1. Scan for publicly reachable BioStar 2 Video Extension endpoints
2. Send crafted requests containing directory traversal payloads
3. Read sensitive server files such as config or credential stores
4. Leverage obtained data to escalate access or compromise physical security systems

How to detect it

Examine web server and application logs for requests to video-related endpoints that contain repeated ../ or encoded traversal sequences and that result in successful file reads outside expected directories.

• ../
• ..%2f
• ..%5c
• GET.*video.*\.\./

What your security team should do

• Prioritize upgrade of all BioStar 2 deployments to 2.8.2 or later within the next 30 days given the 0.5 EPSS score and weaponized exploit status
• Apply network segmentation or firewall rules to limit access to the Video Extension
• Review web access logs for historical traversal attempts and rotate any exposed credentials