EUVD-2026-60161
GHSA-pp45-9qg8-f483
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Requires an existing high-privilege account (PR:H) over the network; impact is disclosure of embedded credentials (C:H) with no described modification or availability loss (I:N/A:N), and S:C reflects that stolen secrets affect connected systems.
Primary rating from Vendor (TR-CERT).
CVSS VectorVendor: TR-CERT
Lifecycle Timeline
3DescriptionCVE.org
Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data.
This issue affects Logsign SIEM: from 6.4.97 before 6.4.114.
AnalysisAI
Credential exposure in Logsign SIEM (versions 6.4.97 up to but not including 6.4.114) allows a high-privilege authenticated user to retrieve embedded sensitive data such as stored integration or log-source credentials. The issue was reported by Turkey's national CERT (TR-CERT, advisory TR-26-0847) and carries a vendor CVSS of 9.0; a fixed release (6.4.114) is available and no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account with high privileges on the Logsign SIEM (CVSS PR:H) and a vulnerable version in the range 6.4.97 through 6.4.113; the attacker then uses the SIEM's own functionality to read back embedded/stored credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L) yields 9.0, but the most important signal is PR:H: exploitation requires an existing high-privilege account, so this is a privilege-abuse / post-compromise credential-harvesting issue rather than a remotely-triggerable unauthenticated break. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Logsign SIEM 6.4.114 or later, which is the vendor-released patched version and the first build outside the affected range; a patch is confirmed available per the TR-CERT advisory (https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0847). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify deployed Logsign SIEM versions (check via Settings/About) and immediately escalate versions 6.4.97-6.4.113 to emergency patching status; restrict SIEM administrative access to essential personnel only, and audit admin activity logs for any unauthorized credential access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today