EUVD-2026-80803
GHSA-mj33-2pqx-xfmm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach iDSecure management interface over network
-
DeliverySend unauthenticated request to /api/license/restartService
-
ExploitInternal routine kills and relaunches service via batch script
-
ExecutionRepeat calls in a loop
-
ImpactService held in continuous restart cycle (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker needs network reachability to the iDSecure application's HTTP API - specifically the /api/license/restartService endpoint, which is exposed without any authentication (CWE-306). No credentials, no user interaction, and no non-default configuration are required: the endpoint is reachable and functional in the affected product's normal state. The only meaningful limiting factor is network exposure - if the iDSecure management interface is segmented, firewalled, or otherwise not reachable by the attacker, exploitation is prevented. Affected deployments are those running iDSecure prior to version 4.8.3.0. |
| Impact | This is a genuine availability risk that scores appropriately at CVSS 7.5. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes a remote, low-complexity, unauthenticated attack with no user interaction and pure availability impact - fully consistent with the description of an unauthenticated endpoint that terminates and relaunches the service process. CWE-306 (Missing Authentication for Critical Function) matches precisely. However, real-world urgency is moderated by several signals: there is no EPSS score provided, no CISA KEV listing, and no public exploit code identified, so this is not confirmed active exploitation - only a vendor/Tenable-disclosed weakness. The impact ceiling is availability-only (C:N/I:N/A:H): no data disclosure, no code execution, no integrity loss. Net assessment: a legitimate, easily-triggered DoS worth patching promptly on exposed instances, but not a high-priority mass-exploitation threat, and its low real-world deployment footprint further limits systemic risk. No conflicting signals between the CVSS vector and the description - both consistently indicate remote unauthenticated availability impact. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the iDSecure management interface over the network sends repeated HTTP requests to the /api/license/restartService endpoint. Each call terminates the iDSecure service and relaunches it via a generated batch script, so a tight request loop keeps the service perpetually restarting and unavailable to legitimate users. No exploit code is publicly identified at time of analysis, but the attack is trivial to script given the low complexity and absence of authentication. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
RemediationAI
Upgrade to iDSecure 4.8.3.0 or later, which is the first release outside the affected range and the version where the vendor addressed the missing authentication check; per available patch data, a vendor fix is available. Where immediate upgrading is not possible, apply compensating controls that break reachability of the vulnerable endpoint: terminate or reverse-proxy the iDSecure HTTP interface behind an authenticating proxy or WAF rule that denies requests to /api/license/restartService (and the broader /api/license/ path) from untrusted sources - the trade-off is that license administration must then be performed from an authorized host or through an allowlisted channel. Restrict the management interface to a dedicated administrative VLAN or VPN and firewall the API port so only trusted management hosts can reach it; this fully mitigates remote exploitation but requires network re-architecture and may complicate remote support workflows. If the service does enter a restart loop, stopping the affected service and blocking the offending source before restarting prevents immediate re-triggering. Monitor service-process restart frequency and API logs for repeated hits on /api/license/restartService as a detection signal, and consult the vendor advisory and Tenable's TRA-2026-56 (https://www.tenable.com/security/research/tra-2026-56) for confirmation and any additional guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a missing-authentication-for-critical-function defect (CWE-306) in the web API of Control iD iDSecure, an access-control/identity management platform identified in the CPE data as cpe:2.3:a:control_id:idsecure. The /api/license/restartService endpoint is exposed over HTTP without any authentication or authorization check and directly triggers an internal routine that terminates the iDSecure service process and then relaunches it through a generated batch script. Because the restart is script-driven rather than atomic, each invocation consumes a restart cycle; an attacker who repeats requests faster than the service can stabilize keeps the process from ever reaching a serving state. The vulnerability class is authentication bypass of an administrative function - the endpoint should be reserved for privileged operators but is reachable by anyone who can route packets to the API, which is why no PR/UI/AC mitigating factors appear in the assessed vector. Exploitation does not require malformed input, a crafted payload, or any non-default deployment state; the only precondition is that the iDSecure management interface be reachable, since segmentation or firewall rules blocking the API would prevent the attack entirely. Tenable's research advisory TRA-2026-56 and ENISA EUVD entry EUVD-2026-80803 both track the issue.
Know when Idsecure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Endpoint is network-reachable with no authentication (AV:N/PR:N/UI:N) and trivially triggered (AC:L); impact is availability-only service restart loop (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
Executive ViewAI
Control iD iDSecure versions prior to 4.8.3.0 contain an unauthenticated denial-of-service vulnerability that can render the service unavailable, disrupting physical access control management. This flaw allows any network-reachable attacker to hold the service in a continuous restart cycle by repeatedly calling a license-restart API endpoint, potentially causing operational downtime and security gaps for facilities relying on iDSecure. There is no public exploit identified at time of analysis, but the simplicity of the attack and the high availability impact (CVSS 7.5) make prompt patching essential.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /
Exploit-DB