CVE-2025-56699 is a critical SQL injection vulnerability identified in the cmd component of Centrax Open PSIM version 6.1, a product developed by Base Digitale Group spa. The vulnerability arises from improper sanitization of the 'sender' parameter, which can be manipulated by unauthenticated attackers to inject and execute arbitrary SQL commands against the backend database. This type of injection flaw can allow attackers to bypass authentication, extract sensitive data, modify or delete records, and potentially disrupt the availability of the PSIM system. The lack of authentication requirement significantly lowers the barrier to exploitation, increasing the threat level. Centrax Open PSIM is a Physical Security Information Management platform used to integrate and manage multiple security systems, making it a high-value target for attackers aiming to compromise physical security controls. Although no CVSS score or patches have been released as of the publication date, the vulnerability's nature and context suggest a critical security risk. No known exploits have been publicly reported yet, but the potential for exploitation remains high due to the straightforward attack vector. Organizations relying on this platform should urgently assess exposure and implement mitigations to prevent exploitation.

For European organizations, the impact of this vulnerability can be severe. Compromise of Centrax Open PSIM could lead to unauthorized access to sensitive security data, manipulation of security events, and disruption of physical security operations. This could result in breaches of physical premises, loss of sensitive information, and operational downtime. Critical infrastructure sectors such as transportation, energy, government facilities, and large enterprises using PSIM solutions are particularly at risk. The ability for unauthenticated attackers to exploit this vulnerability increases the likelihood of attacks, potentially leading to widespread disruption. Additionally, regulatory compliance issues may arise if personal or sensitive data is exposed or if security controls are bypassed. The lack of a patch means organizations must rely on compensating controls, increasing operational complexity and risk.

Given the absence of an official patch, European organizations should implement immediate compensating controls. These include: 1) Applying strict input validation and sanitization on all user-supplied parameters, especially the 'sender' parameter, to prevent injection attacks. 2) Restricting network access to the Centrax Open PSIM management interfaces to trusted IP addresses and using network segmentation to isolate the system from untrusted networks. 3) Deploying Web Application Firewalls (WAFs) or database activity monitoring tools to detect and block suspicious SQL queries. 4) Conducting thorough security audits and penetration tests focused on injection vulnerabilities within the PSIM environment. 5) Monitoring logs for unusual database queries or failed login attempts that may indicate exploitation attempts. 6) Preparing incident response plans specific to PSIM compromise scenarios. 7) Engaging with the vendor for timely updates and patches and planning for rapid deployment once available.