CVE-2025-22372 HIGH

CVE-2025-22372: Insecure password storage in SicommNet BASEC

Vendor Sicommnet

Product BASEC

Weakness CWE-522 · Insufficiently protected credentials

Published April 14, 2025

Last update April 15, 2025

View on NVD All CVEs

CVSS base score

8.4/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/V:C

What the vulnerability does

01Description

Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.

Key dates

02Disclosure timeline

April 14, 2025 CVE published

April 15, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-22372 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/522.html

Related vulnerabilities

04Related CVE

CVE-2021-47741 ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration Endpoint CVE-2024-29992 Azure Identity Library for .NET Information Disclosure Vulnerability CVE-2023-43633 Debug Functions Unlockable Without Triggering Measured Boot CVE-2026-20791 Chargemap chargemap.com Insufficiently Protected Credentials CVE-2025-15621 Sparx Enterprise Architect Client does not verify the receiver of OAuth2 credentials during OpenID authentication