Cyber Resilience

CVE-2025-26852

Critical

Published: 20 March 2025

Published
20 March 2025
Modified
23 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0024 46.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26852 is a critical-severity SQL Injection (CWE-89) vulnerability in Descor Infocad. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26852 is a SQL injection vulnerability (CWE-89) present in DESCOR INFOCAD versions 3.5.1 and earlier. The flaw allows attackers to inject malicious SQL code into backend queries. It was published on 2025-03-20 and carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of privileges or user interaction needed, and high impacts across confidentiality, integrity, and availability with scope change.

Remote, unauthenticated attackers can exploit this vulnerability over the network without user interaction. By injecting crafted SQL payloads, they can execute arbitrary database commands, potentially leading to unauthorized data access, modification, deletion, or escalation to broader system compromise given the high impact ratings and scope change.

Mitigation is available in DESCOR INFOCAD v3.5.2.0, which addresses the SQL injection issue. Security practitioners should reference the product page at https://www.descor.com/prodotti/infocad and the changelog at https://www.infocadfm.com/changelog/sql-injection/ for patch details and upgrade instructions.

EU & UK References

Vulnerability details

DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection.

CWE(s)
CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in a publicly accessible web application directly enables initial access via exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-26853Same product: Descor Infocad
CVE-2026-39334Shared CWE-89
CVE-2024-13488Shared CWE-89
CVE-2026-20002Shared CWE-89
CVE-2025-1446Shared CWE-89
CVE-2025-22699Shared CWE-89
CVE-2026-36232Shared CWE-89
CVE-2026-31871Shared CWE-89
CVE-2026-33078Shared CWE-89
CVE-2026-46359Shared CWE-89

Affected Assets

descor
infocad
≤ 3.5.2.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SQL injection by validating and sanitizing untrusted inputs before incorporation into database queries.

SI-2 Flaw Remediation good match
prevent

Requires timely remediation of identified flaws, such as applying the vendor patch in DESCOR INFOCAD v3.5.2.0 to eliminate the SQL injection vulnerability.

SC-7 Boundary Protection partial match
preventdetect

Deploys boundary protections like web application firewalls to inspect traffic and block or detect SQL injection payloads targeting the vulnerable application.

References