Anviz CrossChex Standard Algorithm Downgrade Vulnerability Allowing Cleartext Database Credential Transmission

A vulnerability exists in Anviz CrossChex Standard that allows an attacker to manipulate the TDS7 PreLogin process to disable encryption. This action results in database credentials being transmitted in plaintext, which could lead to unauthorized access to the database.

Impact

Exploitation of this vulnerability could result in unauthorized access to the database, allowing attackers to view, modify, or delete database information.

Remediation

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information.