Logsign SIEM CVE-2026-90924

Exploitation requires network reachability to the Logsign SIEM authentication/management interface and that the deployed instance (6.4.101 through 6.4.116) still uses vendor default or unchanged common credentials. What limits exploitation: an operator who rotated the default account password at install, or who restricts management-interface exposure to a trusted network, is not exploitable despite the version match. No user interaction and no prior authentication are needed (PR:N/UI:N) when defaults remain in place.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8 Critical) is internally consistent with a default-credentials flaw (CWE-1392): a remote, unauthenticated attacker who tries known/default username-password pairs against an exposed Logsign SIEM instance gains full confidentiality, integrity and availability impact. The high score is well-justified in principle - default-credential bugs are trivially automatable and require no special skill. However, the real-world risk is tempered by missing corroborating signals: there is no EPSS probability provided, no CISA KEV listing, and no public POC in the supplied intelligence, so exploitation status is 'no public exploit identified at time of analysis'. The vendor has published a fix (6.4.117), and exploitation depends on the SIEM management/login interface being network-reachable and on default credentials not having been changed by the operator - a well-administered deployment that rotated credentials post-install is not exploitable. Net: a genuinely dangerous, easy-to-exploit class of flaw in a security-critical product, but priority is moderated by the product's limited deployment footprint and the absence of confirmed active exploitation. Note also the input Tag 'Information Disclosure' understates impact - this is a full-compromise (C:H/I:H/A:H) issue, not infoleak-only.

An attacker locates an internet- or LAN-exposed Logsign SIEM login interface (version 6.4.101-6.4.116) and submits vendor default or commonly-used credentials that were never changed after deployment. Authentication succeeds, granting full administrative control of the SIEM - allowing the attacker to read all ingested security logs, tamper with or delete evidence, and disrupt monitoring. No public exploit code is required beyond trying known default credential pairs.