Anviz Crosschex Standard CVE-2026-32650

Exploitation requires network connectivity to the Anviz CrossChex Standard database server (typically Microsoft SQL Server or compatible TDS7 endpoint) on database listener ports (default TCP 1433). No authentication, user interaction, or non-default configuration is required per CVSS vector AV:N/AC:L/PR:N/UI:N. The vulnerability is exploitable against default CrossChex Standard deployments. Limiting factors: attacker must be positioned on a network segment with routing to the database server (not exploitable over the public internet unless database is improperly exposed). Passive exploitation via sniffing requires shared network medium (switched LANs require ARP spoofing or switch compromise). Active man-in-the-middle downgrade attacks require inline network position or compromised routing infrastructure.

CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates network-based exploitation with low complexity, no authentication required, and high confidentiality impact. This is a realistic threat: network-adjacent attackers (including those on corporate LANs or via VPN compromise) can passively intercept or actively downgrade TDS connections to capture plaintext credentials. The Authentication Bypass tag and ICS-CERT reporting suggest deployment in operational technology environments where credential theft enables lateral movement to industrial control networks. However, scope is unchanged (U) and impact limited to confidentiality - no direct code execution or availability disruption. Real-world risk depends heavily on network segmentation: if CrossChex databases are exposed beyond isolated management networks, risk escalates significantly. EPSS probability and KEV status are not provided, preventing assessment of active exploitation likelihood. No CVE references include proof-of-concept code, suggesting exploitation requires moderate protocol manipulation skills rather than script-kiddie attacks. SSVC decision factors: exploitation status unknown, likely automatable via TDS protocol tools, technical impact limited to credential disclosure. Priority depends on whether stolen database access enables further attacks on physical security systems.

An attacker on the corporate network sends a malicious TDS7 PreLogin packet to the CrossChex Standard database server, forcing encryption downgrade. The server complies and accepts plaintext authentication, transmitting database credentials unencrypted. The attacker captures credentials via packet sniffing, then authenticates directly to the SQL Server backend containing employee records, access logs, and physical security configuration data.