CVE-2026-32650

Anviz CrossChex Standard is vulnerable when an attacker manipulates the TDS7 PreLogin to disable encryption, causing database credentials to be sent in plaintext and enabling unauthorized database access.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json	Third Party Advisory
https://www.anviz.com/contact-us.html	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03	US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:anviz:crosschex_standard:-:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Anviz CrossChex Standard es vulnerable cuando un atacante manipula el PreLogin de TDS7 para deshabilitar el cifrado, lo que provoca que las credenciales de la base de datos se envíen en texto plano y permite el acceso no autorizado a la base de datos.

Information

Published : 2026-04-17 20:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-32650

Mitre link : CVE-2026-32650

CVE.ORG link : CVE-2026-32650

JSON object : View

Products Affected

anviz

crosschex_standard

CWE

CWE-757

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

{"id": "CVE-2026-32650", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32650", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T20:26:08.787769Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ics-cert@hq.dhs.gov", "affectedData": [{"vendor": "Anviz", "product": "Anviz CrossChex Standard", "versions": [{"status": "affected", "version": "All versions"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-17T20:16:34.360", "references": [{"url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-106-03.json", "tags": ["Third Party Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.anviz.com/contact-us.html", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-03", "tags": ["US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-757"}]}], "descriptions": [{"lang": "en", "value": "Anviz CrossChex Standard\u00a0is vulnerable when an attacker manipulates the TDS7 PreLogin to disable \nencryption, causing database credentials to be sent in plaintext and \nenabling unauthorized database access."}, {"lang": "es", "value": "Anviz CrossChex Standard es vulnerable cuando un atacante manipula el PreLogin de TDS7 para deshabilitar el cifrado, lo que provoca que las credenciales de la base de datos se env\u00eden en texto plano y permite el acceso no autorizado a la base de datos."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:anviz:crosschex_standard:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "155C659B-9DDA-46B7-9020-0D8741D19926"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}