Anviz CrossChex Standard Improper Verification of Source in Client-Server Communication Vulnerability

A vulnerability exists in Anviz CrossChex Standard due to a lack of source verification in the client/server communication channel. This flaw allows an attacker on the same network to inject TCP packets, potentially altering or disrupting application traffic. Additionally, this vulnerability could be exploited to gain unauthorized access to database credentials, which are transmitted unencrypted, enabling unauthorized database access.

Impact

Exploitation of this vulnerability could lead to unauthorized interception and modification of application traffic, as well as unauthorized access to database credentials, allowing access to the database.

Remediation

Anviz did not respond to CISA's attempts to coordinate these vulnerabilities. Users should contact Anviz for more information.