CVE-2025-22492mediumCWE-922

CVE-2025-22492: medium-severity vulnerability in Eaton Foreseer Reporting Software (FRS)

Insecure storage of connection strings in FRS

Published

Follow this CVE+ Monitor Foreseer Reporting

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.2%
The connection string visible to users with access to FRSCore database on Foreseer Reporting Software (FRS) VM, this string can be used for gaining administrative access to the 4crXref database. This vulnerability has been resolved in the latest version 1.5.100 of FRS.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Affected products
Eaton · Foreseer Reporting Software (FRS)
Related CVEs — Eaton Foreseer Reporting Software (FRS)

In the same product, most dangerous first.

CVE-2025-22491MEDIUMImproper Input Validation in Foreseer Reporting Software (FRS)EPSS 0.2%CVE-2025-22493MEDIUMImproper cookie attributes in Foreseer Reporting Software (FRS)EPSS 0.1%