by Kastro
Paper/Archive/CVE-2025-22372

CVE-2025-22372

SicommNet BASEC — Insecure password storage in SicommNet BASEC

EPSS 0.2%CVSS 9.3
critical.is priorityof 100
30
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 12.3.123 × 202.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.

Affected

ProductAffectedFixed inSource
BASEC14 Dec 2021 – *–CNA

Scores by source

DIVD (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/AU:Y/V:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refbasec.sicomm.net/loginwriteupcsirt.divd.nl/DIVD-2025-00001writeupcsirt.divd.nl/CVE-2025-22372