CVE-2025-22371
Last modified
CVE-2025-22371 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time). EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-22371?
How severe is CVE-2025-22371?
How do I fix CVE-2025-22371?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-22366The authenticated firmware update capability of the firmware…8.7
- CVE-2025-22367The authenticated time setting capability of the firmware fo…8.7
- CVE-2025-22368The authenticated SCU firmware command of the firmware for M…8.7
- CVE-2025-22369The ReadFile endpoint of the firmware for Mennekes Smart / P…7.1
- CVE-2025-2237The WP RealEstate plugin for WordPress, used by the Homeo th…9.8
- CVE-2025-22370Many fields for the web configuration interface of the firmw…5.3
- CVE-2025-22372Insufficiently Protected Credentials vulnerability in Sicomm…9.3
- CVE-2025-22373Improper Neutralization of Input During Web Page Generation …8.7
- CVE-2025-22374A Server-Side Request Forgery (SSRF) vulnerability was disco…6
- CVE-2025-22375An authentication bypass vulnerability was found in Videx's …9.3
- CVE-2025-22376In Net::OAuth::Client in the Net::OAuth package before 0.29 …5.3
- CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearabl…6.5
Are you affected by CVE-2025-22371?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST