CVE-2025-22372
Last modified
CVE-2025-22372 is a critical-severity vulnerability rated 9.3/10 on the CVSS scale. Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:C/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-22372?
How severe is CVE-2025-22372?
How do I fix CVE-2025-22372?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-22367The authenticated time setting capability of the firmware fo…8.7
- CVE-2025-22368The authenticated SCU firmware command of the firmware for M…8.7
- CVE-2025-22369The ReadFile endpoint of the firmware for Mennekes Smart / P…7.1
- CVE-2025-2237The WP RealEstate plugin for WordPress, used by the Homeo th…9.8
- CVE-2025-22370Many fields for the web configuration interface of the firmw…5.3
- CVE-2025-22371Improper Neutralization of Special Elements used in an SQL C…9.3
- CVE-2025-22373Improper Neutralization of Input During Web Page Generation …8.7
- CVE-2025-22374A Server-Side Request Forgery (SSRF) vulnerability was disco…6
- CVE-2025-22375An authentication bypass vulnerability was found in Videx's …9.3
- CVE-2025-22376In Net::OAuth::Client in the Net::OAuth package before 0.29 …5.3
- CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearabl…6.5
- CVE-2025-2238The Vikinger theme for WordPress is vulnerable to privilege …8.8
Are you affected by CVE-2025-22372?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST