CVE-2026-32650

{
  "id": "CVE-2026-32650",
  "sourceIdentifier": "[email protected]",
  "published": "2026-04-17T20:16:34.360",
  "lastModified": "2026-10-26T21:10:00.170",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable \nencryption, causing database credentials to be sent in plaintext and \nenabling unauthorized database access."
    },
    {
      "lang": "es",
      "value": "Anviz CrossChex Standard es vulnerable cuando un atacante manipula el PreLogin de TDS7 para deshabilitar el cifrado, lo que provoca que las credenciales de la base de datos se envíen en texto plano y permite el acceso no autorizado a la base de datos."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Anviz",
          "product": "Anviz CrossChex Standard",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "All versions",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-04-17T20:26:08.787769Z",
          "id": "CVE-2026-32650",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-757"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:anviz:crosschex_standard:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "155C659B-9DDA-46B7-9020-0D8741D19926"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json",
      "source": "[email protected]",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.anviz.com/contact-us.html",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03",
      "source": "[email protected]",
      "tags": [
        "US Government Resource"
      ]
    }
  ]
}