This vulnerability allows an attacker to manipulate the TDS7 PreLogin negotiation of Anviz CrossChex Standard so that encryption is disabled. As a result, database credentials are transmitted in clear text, enabling the attacker to capture them and gain unauthorized access to the backend database. The weakness is categorized as CWE‑757 due to the inappropriate use of algorithmic downgrade.

The affected product is Anviz CrossChex Standard. No specific version information was disclosed, so all deployed units of this model should be considered at risk until further notice.

The CVSS score of 7.5 indicates a high severity, but the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through the device’s network interface that processes TDS7 PreLogin messages; an adversary would need to transmit a crafted packet or intercept traffic to override the encryption setting. Given the lack of publicly available exploits, the immediate risk remains limited, yet the potential for credential theft warrants prompt action.