CI-ISAC Australia Ltd

{
  "containers": {
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:best_practice_software:bp_premier:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "affected",
          "product": "Bp Premier",
          "vendor": "Best Practice Software",
          "versions": [
            {
              "status": "affected",
              "version": "1.12.1.1023"
            },
            {
              "status": "affected",
              "version": "1.12.3.1042"
            },
            {
              "status": "affected",
              "version": "1.13.1.1080"
            },
            {
              "status": "affected",
              "version": "1.13.1.1096"
            },
            {
              "status": "affected",
              "version": "1.14.0.1114"
            },
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.14.1.1129",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Independent researcher who elected to remain unnamed."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrew Tunnecliffe (CI-ISAC Australia)."
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "CI-ISAC Australia, National Intelligence Office."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Best Practice Software Bp Premier uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations; in affected versions, the credential could not be changed without breaking the application. An attacker with network access to the database instance can use this credential to bypass application authentication and gain sysadmin privileges, allowing for arbitrary operating-system command execution (typically as SYSTEM). Exploitability depends entirely on the database\u0027s network exposure."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-522",
              "description": "CWE-522 Insufficiently Protected Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "orgId": "b2ca432d-cded-42d0-8f57-c6a1a430c957",
        "shortName": "CI-ISAC"
      },
      "references": [
        {
          "name": "CI-ISAC Australia Vulnerability Disclosure Policy",
          "url": "https://ci-isac.org.au/vulnerability-disclosure-policy"
        },
        {
          "name": "Vendor release notes (Oxford SP1)",
          "tags": [
            "release-notes"
          ],
          "url": "https://kb.bestpracticesoftware.com/bppremier/oxford/WhatsNew/BpPremier_OxfordSP1_ReleaseNotes.htm"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to Bp Premier 1.14.1.1129 (Oxford SP1) or later."
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-26T00:00:00.000Z",
          "value": "Reported to CI-ISAC Australia by anonymous third party."
        },
        {
          "lang": "en",
          "time": "2026-06-03T00:00:00.000Z",
          "value": "Independently verified by CI-ISAC Australia; additional detail established."
        },
        {
          "lang": "en",
          "time": "2026-09-25T00:00:00.000Z",
          "value": "Coordinated public disclosure."
        }
      ],
      "title": "Best Practice Software Bp Premier ships a hardcoded, shared SQL Server administrative credential",
      "workarounds": [
        {
          "lang": "en",
          "value": "The following reduce reachability and blast radius but do not remove the vulnerability. Restrict network access to the Bp Premier SQL Server listener so it is reachable only from the Bp Premier server; do not expose the SQL Server listener to untrusted networks, remote-access paths, or the public internet; apply least privilege to the SQL Server service account where the deployment supports it; and monitor for anomalous direct SQL Server authentication and for enabling of operating-system command execution features."
        }
      ],
      "x_gcve": [
        {
          "recordType": "advisory",
          "vulnId": "GCVE-123-2026-0001"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b2ca432d-cded-42d0-8f57-c6a1a430c957",
    "assignerShortName": "CI-ISAC",
    "datePublished": "2026-09-25T00:00:00.000Z",
    "dateReserved": "2026-06-11T00:00:00.000Z",
    "dateUpdated": "2026-09-25T07:35:42.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2.0"
}