An unhandled exception occurs in the Suprema BioStar 2 server when an HTTP POST request is sent to the /api/migration endpoint. The error halts critical processes, causing the system to become unavailable until services or the server are restarted. Because the flaw does not require authentication or user interaction, an attacker can trigger it from any network reachable to the endpoint, resulting in a high‑impact denial of service that also disrupts access control readers and may break third‑party integrations.

Suprema BioStar 2 (Server) versions 2.9.8, 2.9.10, and 2.9.11 are affected. Clients running these firmware releases are vulnerable to unauthorized remote DoS attacks via the /api/migration endpoint.

The CVSS score of 8.7 indicates a high severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. However, the absence of authentication requirements and the trivial automation of the trigger mean the vulnerability is readily exploitable by unauthenticated remote actors. The likelihood of exploitation is high and can propagate to interconnected systems.