EUVD-2026-80803Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Endpoint is network-reachable with no authentication (AV:N/PR:N/UI:N) and trivially triggered (AC:L); impact is availability-only service restart loop (C:N/I:N/A:H), no scope change.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
AnalysisAI
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker needs network reachability to the iDSecure application's HTTP API - specifically the /api/license/restartService endpoint, which is exposed without any authentication (CWE-306). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine availability risk that scores appropriately at CVSS 7.5. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to iDSecure 4.8.3.0 or later, which is the first release outside the affected range and the version where the vendor addressed the missing authentication check; per available patch data, a vendor fix is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Control iD iDSecure deployments (especially those with the /api/license/restartService endpoint exposed) and restrict network access to the management interface using firewalls or access control lists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today