SQL Injection in Sicommnet Basec
CVE-2025-22371
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SicommNet BASEC (SaaS Service) login page allows an unauthenticated remote attacker to Bypass Authentication and execute arbitrary SQL commands.This issue at least affects BASEC for the date of 14 Dec 2021 onwards. It is very likely that this vulnerability has been present in the solution before that. The issue was fixed by SicommNet around 11pm on 16 april 2025 (Eastern Time)
Vulnerability class: SQL Injection
Published · last modified .
EPSS exploit prediction
EPSS: 0.006 (46.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 46th percentile — 46.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: +0.000
Affected products
- Sicommnet Basec — versions 14 Dec 2021, 16 April 2025 23:00 EST
Weakness classification (CWE)
Public proof-of-concept exploits
References
- basec.sicomm.net/ (product)
- csirt.divd.nl/DIVD-2025-00001 (third-party-advisory)
- csirt.divd.nl/CVE-2025-22371 (third-party-advisory)
Frequently asked questions
- What is CVE-2025-22371?
- CVE-2025-22371 is a vulnerability in Sicommnet Basec, classified under SQL Injection. Published 2025-04-14.
- Is CVE-2025-22371 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.