What’s Vulnerable › Vulnerabilities

CVE-2025-22372: Insecure password storage in SicommNet BASEC

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-14 · updated 2026-06-17
• Weakness: CWE-522

Description

Insufficiently Protected Credentials vulnerability in SicommNet BASEC on SaaS allows Password Recovery. Passwords are either stored in plain text using reversible encryption, allowing an attacker with sufficient privileges to extract plain text passwords easily. This issue affects BASEC: from 14 Dec 2021.

Affected products

• SicommNet BASEC: from 14 Dec 2021

References

• https://basec.sicomm.net/login/
• https://csirt.divd.nl/CVE-2025-22372
• https://csirt.divd.nl/DIVD-2025-00001

Get alerted when CVE-2025-22372 or the next vulnerability affects your stack