Database — CraftedSignal Threat Feed

Anviz CrossChex Standard TDS7 PreLogin Encryption Vulnerability

hello@craftedsignal.io — Sat, 18 Apr 2026 12:00:00 +0000

Anviz CrossChex Standard is susceptible to a critical vulnerability (CVE-2026-32650) where an attacker can manipulate the TDS7 PreLogin process. By exploiting this flaw, an attacker can disable encryption mechanisms, causing sensitive database credentials to be transmitted in plaintext. This exposure enables unauthorized access to the underlying database, potentially leading to data breaches, modification of records, or other malicious activities. The vulnerability was disclosed in April 2026 and poses a significant risk to organizations utilizing the affected Anviz CrossChex Standard software. The vulnerability exists because the application allows for a downgrade to a less secure algorithm during negotiation.

Attack Chain

The attacker identifies an Anviz CrossChex Standard instance exposed to network access.
The attacker initiates a connection to the TDS7 PreLogin port.
The attacker crafts a malicious TDS7 PreLogin packet to negotiate a connection without encryption.
The CrossChex Standard software, due to the vulnerability, accepts the unencrypted connection.
The software transmits database credentials in plaintext over the unencrypted channel.
The attacker intercepts the plaintext database credentials.
The attacker uses the obtained credentials to authenticate directly to the database server.
The attacker gains unauthorized access to the CrossChex Standard database, enabling them to read, modify, or delete sensitive data.

Impact

Successful exploitation of CVE-2026-32650 allows unauthorized access to the Anviz CrossChex Standard database. This can lead to the exposure of sensitive employee data, including personal information and access control details. Depending on the database permissions, an attacker could also modify time and attendance records, manipulate user accounts, or even compromise the entire physical access control system managed by CrossChex Standard. The impact could range from privacy violations to significant security breaches affecting physical premises.

Recommendation

Apply available patches or updates for Anviz CrossChex Standard as provided by the vendor to remediate CVE-2026-32650.
Monitor network traffic for connections to the TDS7 PreLogin port that do not negotiate encryption using the provided network connection Sigma rule.
Restrict network access to the TDS7 PreLogin port only to trusted hosts and networks using firewall rules to mitigate the risk of unauthorized access.
Enable logging on the database server and monitor for successful logins from unusual IP addresses or accounts after applying the network connection Sigma rule.

Firebird Server Denial-of-Service Vulnerability (CVE-2026-28224)

hello@craftedsignal.io — Sat, 18 Apr 2026 10:00:00 +0000

CVE-2026-28224 describes a denial-of-service vulnerability affecting Firebird, an open-source relational database management system. The vulnerability exists in versions prior to 5.0.4, 4.0.7, and 3.0.14. An unauthenticated attacker can exploit this vulnerability by sending a crafted op_crypt_key_callback packet to the server. When the server receives this packet without prior authentication, the port_server_crypt_callback handler is not initialized, resulting in a null pointer dereference. This leads to a server crash, effectively causing a denial-of-service condition. The attacker only needs to know the server’s IP address and port to trigger this vulnerability. The vulnerability has been patched in Firebird versions 5.0.4, 4.0.7 and 3.0.14.

Attack Chain

The attacker identifies a vulnerable Firebird server by scanning for exposed ports (typically 3050).
The attacker establishes a TCP connection with the targeted Firebird server on the identified port.
The attacker crafts a malicious op_crypt_key_callback packet. This packet does not require prior authentication.
The attacker sends the crafted op_crypt_key_callback packet to the Firebird server.
Upon receiving the packet, the server attempts to process the request in the port_server_crypt_callback handler.
Because no prior authentication has occurred, the port_server_crypt_callback handler is not properly initialized, leading to a null pointer dereference.
The null pointer dereference causes the Firebird server process to crash.
The Firebird database server becomes unavailable, resulting in a denial-of-service condition for legitimate users.

Impact

Successful exploitation of CVE-2026-28224 results in a denial-of-service condition, rendering the Firebird database server unavailable. This can disrupt applications and services that rely on the database, leading to data access issues, application downtime, and potential data loss if proper backup and recovery mechanisms are not in place. The number of affected organizations depends on the prevalence of vulnerable Firebird versions and their exposure to the network.

Recommendation

Upgrade Firebird servers to versions 5.0.4, 4.0.7, or 3.0.14 or later to patch CVE-2026-28224.
Deploy the Sigma rule “Detect Unauthenticated Firebird Crypt Callback” to your SIEM to identify potential exploitation attempts targeting this vulnerability.
Implement network segmentation and access control lists (ACLs) to restrict access to Firebird servers from untrusted networks, mitigating the risk of unauthorized exploitation (network_connection logs).
Monitor network traffic for suspicious op_crypt_key_callback packets being sent to Firebird servers, particularly from untrusted sources (network_connection logs).

Firebird Path Traversal Vulnerability Leads to Code Execution (CVE-2026-40342)

hello@craftedsignal.io — Fri, 17 Apr 2026 20:16:35 +0000

Firebird, an open-source relational database management system, is vulnerable to a path traversal flaw (CVE-2026-40342) in versions prior to 5.0.4, 4.0.7, and 3.0.14. This vulnerability resides within the external engine plugin loader. The loader concatenates a user-supplied engine name into a filesystem path without proper sanitization, leaving it open to path traversal attacks. An authenticated user with CREATE FUNCTION privileges can craft a malicious ENGINE name containing path separators and .. components. This allows them to load an arbitrary shared library from anywhere on the filesystem. The library’s initialization code executes immediately upon loading, before Firebird can validate the module, effectively granting code execution under the security context of the server’s operating system account. Upgrading to versions 5.0.4, 4.0.7, or 3.0.14 resolves this issue.

Attack Chain

Attacker authenticates to the Firebird database server with an account possessing CREATE FUNCTION privileges.
Attacker crafts a malicious ENGINE name that includes path traversal sequences (e.g., ../../../../).
The attacker uses the crafted ENGINE name in a CREATE FUNCTION statement, specifying a path to an arbitrary shared library on the filesystem. For example, CREATE FUNCTION evil_func RETURNS INTEGER ENGINE '/path/to/evil/../../../../tmp/evil.so'.
The Firebird server’s plugin loader concatenates the provided ENGINE name into a filesystem path without proper validation.
The Firebird server attempts to load the shared library from the attacker-controlled path, effectively bypassing intended access controls.
The operating system loads the shared library into the Firebird server’s process.
The shared library’s initialization code executes immediately, granting the attacker arbitrary code execution within the context of the Firebird server process.
The attacker gains control of the Firebird server’s OS account, potentially leading to data exfiltration, system compromise, or denial of service.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the Firebird server with the privileges of the operating system account running the Firebird service. This can lead to full system compromise, including data exfiltration, modification, or destruction. Given the high CVSS score of 9.9, this vulnerability poses a critical risk to organizations using vulnerable Firebird versions. The impact could range from complete database compromise to lateral movement within the network, depending on the privileges of the Firebird service account.

Recommendation

Upgrade Firebird servers to versions 5.0.4, 4.0.7, or 3.0.14 to patch CVE-2026-40342.
Monitor Firebird server logs for CREATE FUNCTION statements with suspicious ENGINE names containing path traversal sequences, and deploy the Sigma rule Detect Firebird Create Function Path Traversal to your SIEM.
Implement strict access controls to limit CREATE FUNCTION privileges to only authorized users, and enable audit logging on all Firebird database servers to monitor user activity.

Oracle MySQL Multiple Vulnerabilities

hello@craftedsignal.io — Tue, 24 Mar 2026 12:40:50 +0000

This advisory from the German BSI highlights the risk of multiple vulnerabilities affecting Oracle MySQL. An attacker, either unauthenticated or authenticated, can remotely exploit these weaknesses. Successful exploitation could lead to complete compromise of the MySQL server, including unauthorized access to sensitive data, modification of data, and denial of service. The advisory does not specify particular versions or CVEs, indicating a broad range of potential issues. Defenders should prioritize patching and hardening MySQL instances to mitigate potential risks. Due to the widespread use of MySQL, this poses a significant threat to organizations relying on this database system.

Attack Chain

The attacker identifies a vulnerable Oracle MySQL instance exposed to the network.
The attacker attempts to connect to the MySQL server, potentially anonymously or using stolen credentials.
The attacker exploits a vulnerability in the MySQL server software, such as a buffer overflow or SQL injection flaw.
Successful exploitation allows the attacker to execute arbitrary code on the server.
The attacker gains unauthorized access to sensitive data stored in the database, such as user credentials or financial records.
The attacker modifies data within the database, potentially corrupting critical information or injecting malicious code.
The attacker launches a denial-of-service attack against the MySQL server, rendering it unavailable to legitimate users.
The attacker achieves complete compromise of the MySQL server, potentially using it as a pivot point to access other systems on the network.

Impact

Successful exploitation of these MySQL vulnerabilities can lead to severe consequences. Potential impacts include data breaches, financial loss, data corruption, and service disruption. Organizations relying on MySQL for critical applications and data storage are particularly vulnerable. Without specific numbers of victims available, the widespread usage of MySQL implies broad potential impact across various sectors. Successful attacks may lead to significant reputational damage and legal liabilities.

Recommendation

Monitor MySQL server logs for suspicious activity, such as failed login attempts, unusual queries, and unexpected data modifications, to identify potential exploitation attempts.
Deploy the Sigma rule provided below to detect unusual processes spawned by the MySQL server to identify potential exploitation.
Review and enforce strong password policies for all MySQL user accounts to prevent unauthorized access to sensitive data.
Ensure that MySQL instances are not directly exposed to the internet without proper security controls, such as firewalls and intrusion detection systems.

ELBA5 5.8.0 Remote Code Execution Vulnerability

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

ELBA5 version 5.8.0 is vulnerable to a remote code execution (RCE) vulnerability, identified as CVE-2018-25272. This flaw allows unauthenticated attackers to gain unauthorized access to the underlying database and execute arbitrary commands with SYSTEM level privileges on the host. The vulnerability stems from the application’s use of default credentials for database connection, weak password storage, and the availability of powerful stored procedures like xp_cmdshell. Successful exploitation could lead to complete system compromise, sensitive data exposure, and the potential for lateral movement within the network. This vulnerability was published in 2018 but can still be relevant to organizations running older, unpatched versions of ELBA5.

Attack Chain

Attacker identifies a vulnerable ELBA5 5.8.0 instance.
Attacker connects to the database using default connector credentials.
Attacker decrypts the DBA password stored within the database configuration.
Attacker enables the xp_cmdshell stored procedure, if disabled.
Attacker executes arbitrary commands on the host system via xp_cmdshell with SYSTEM privileges. For example, they might use xp_cmdshell 'whoami' to verify their access level.
Alternatively, the attacker adds a backdoor user to the BEDIENER table to maintain persistent access.
Attacker uses the newly created backdoor account to log into the application with elevated privileges.
Attacker exfiltrates sensitive data or performs other malicious actions.

Impact

Successful exploitation of CVE-2018-25272 grants the attacker SYSTEM level access to the server hosting ELBA5. This allows for the complete compromise of the system, including data exfiltration, installation of malware, and potential lateral movement within the network. The attacker can access and potentially modify sensitive data stored within the ELBA5 database, impacting the confidentiality and integrity of the application’s data. The vulnerability allows for the addition of backdoor accounts, ensuring persistence even after the initial vulnerability is patched.

Recommendation

Apply any available patches or upgrades to ELBA5 to address CVE-2018-25272.
Disable or restrict access to the xp_cmdshell stored procedure in the database to prevent command execution as described in the attack chain.
Monitor process creation events for suspicious usage of xp_cmdshell using the provided Sigma rule.
Implement strong password policies and avoid the use of default credentials, mitigating the initial access vector described in the attack chain.
Audit the BEDIENER table for unauthorized user accounts using the provided Sigma rule.
Enable database auditing to detect and respond to suspicious database activity, including attempts to decrypt passwords or modify user accounts.