BaseFortify

Publication date: 2025-04-14

Last updated on: 2026-06-17

Assigner: Dutch Institute for Vulnerability Disclosure

Description

Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-04-14

Last Modified

2026-06-17

Generated

2026-10-23

AI Q&A

2025-10-21

EPSS Evaluated

2026-10-20

NVD

CVE-2025-22372

Affected Vendors & Products

Vendor	Product	Version / Range
SicommNet	BASEC	14 Dec 2021

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

This vulnerability in SicommNet BASEC on SaaS involves insufficient protection of credentials, where passwords are stored either in plain text or using reversible encryption. This allows an attacker with sufficient privileges to easily extract plain text passwords.

Impact Analysis

An attacker who gains sufficient privileges can extract plain text passwords, potentially leading to unauthorized access to user accounts and sensitive information, compromising system security and user privacy.

Compliance Impact

Storing passwords in plain text or with reversible encryption violates best practices for protecting personal data, which can lead to non-compliance with standards like GDPR and HIPAA that require strong protection of sensitive information.

Hi! I’m here to help you understand CVE-2025-22372. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70