CVE-2025-59379
BaseFortify
Publication date: 2026-01-06
Last updated on: 2026-01-08
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| isensix | guardian | 1.5.7 |
| dwyeromega | isensix | 1.5.7 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in DwyerOmega Isensix Advanced Remote Monitoring System (ARMS) 1.5.7 is a Blind SQL Injection through the user parameter on the login page. This allows an attacker to retrieve sensitive information from the underlying SQL database, including stealing credentials of existing users and administrators. These credentials may be in cleartext, enabling the attacker to authenticate to the application as legitimate users.
How can this vulnerability impact me? :
This vulnerability can allow attackers to steal user and administrator credentials, potentially in cleartext, which can lead to unauthorized access to the monitoring system. Unauthorized access could compromise the integrity and confidentiality of environmental monitoring data, disrupt facility operations, and allow attackers to manipulate or disable monitoring functions critical for facility safety and compliance. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively impact compliance with standards like GDPR and HIPAA because it exposes sensitive user credentials and potentially other sensitive data. Unauthorized access resulting from stolen credentials may lead to data breaches, violating data protection and privacy requirements mandated by these regulations. [1]