EUVD-2026-80804
GHSA-8hjh-385q-g4vq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach iDSecure web API
-
DeliverySend request to /api/dguardintegration/dguardVersion
-
ExploitDereference unset DGuard login state
-
ExecutionUnhandled null exception in async void
-
ImpactProcess terminates, service unavailable
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable when the attacker can send an HTTP request to the /api/dguardintegration/dguardVersion endpoint of a Control iD iDSecure instance running a version prior to 4.8.3.0 and the DGuard integration login state is unset (the null-dereference precondition). No authentication or user interaction is required (PR:N/UI:N). Limiting factors: the endpoint must be network-reachable (iDSecure is typically deployed on internal/management networks rather than the public internet), the DGuard integration code path must be present, and the only impact is process termination - recovery requires a service/process restart, so the practical damage is availability outage rather than persistent compromise. |
| Impact | This is a genuine, well-scored remote unauthenticated Denial of Service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a single unauthenticated HTTP request to /api/dguardintegration/dguardVersion triggers a NullReferenceException thrown from an async void method, which .NET treats as an unobserved exception that crashes the entire process. Impact is availability-only (C:N/I:N) - there is no data disclosure or code execution, so despite the HIGH severity label this is a crash bug, not a compromise primitive. No EPSS score, no CISA KEV listing, and no public exploit code are provided, so this is 'no public exploit identified at time of analysis' - priority rests on ease of exploitation rather than confirmed active use. The signals do not conflict: low complexity, no authentication, and process-terminating impact make this a real availability priority for anyone exposing iDSecure, tempered by the fact that iDSecure is a niche access-control product with limited internet exposure. No SSVC decision data was supplied; automatability is plausibly high (single scriptable request) but not vendor-confirmed. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the iDSecure web API sends a crafted request to /api/dguardintegration/dguardVersion while the DGuard integration login state is unset, triggering a null dereference. Because the exception surfaces from an async void method with no observing caller, it propagates as an unobserved exception and terminates the iDSecure process, taking the access-control/attendance service offline. No public proof-of-concept is identified, but the low complexity means exploitation is trivial to script and repeat. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a pure availability impact with no credentials or user interaction required; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the vendor has released a fix.
RemediationAI
Control iD has released a vendor patch, so the primary fix is to upgrade iDSecure to version 4.8.3.0 or later (the first release outside the '< 4.8.3.0' affected range); see the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-56 for details. If an immediate upgrade is not feasible, the most effective compensating control is to restrict network access to the iDSecure HTTP API and management interface - for example, firewall rules or VLAN segmentation that allow only trusted administrative hosts to reach the service - accepting the trade-off that legitimate remote administration is narrowed to those hosts; because the endpoint needs no authentication, blocking reachability is the only control that fully removes the attack path. A second option is to ensure the DGuard integration is fully configured and logged in so the login state is never unset, or to disable/remove the DGuard integration entirely if it is unused, which eliminates the vulnerable code path at the cost of losing DGuard functionality. Finally, configure a service watchdog or auto-restart policy with alerting so that a process-termination event is recovered quickly and detected, while monitoring logs for repeated unhandled null-reference exceptions originating from the DGuard integration endpoint; note that auto-restart does not prevent repeated triggering and can mask an ongoing attack loop, so it should be paired with the network restrictions above rather than used alone.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a CWE-476 NULL pointer dereference in the DGuard integration surface of Control iD iDSecure, an on-premises access-control and credential-management platform. The /api/dguardintegration/dguardVersion endpoint reads DGuard integration login state without checking whether that state has been initialized; when the login state is unset the application dereferences a null object and raises an unhandled null-reference exception. Critically, the exception is thrown from an asynchronous method that returns void - the fire-and-forget async pattern commonly found in .NET services - so no caller ever observes or catches it, and the unhandled exception propagates to the top of the process, terminating the iDSecure service. There is no memory corruption, code execution, data disclosure, or integrity impact: the entire consequence is process termination and the resulting outage. Exploitation requires only network reachability to the affected API endpoint (typically the management/internal interface of the iDSecure server) and the precondition that the DGuard integration login state remains unset, which does not require any privileges. Because the request is unauthenticated (PR:N) and needs no user interaction (UI:N) with low attack complexity (AC:L), the practical barrier is simply reaching the endpoint - hence the elevated 7.5 base score despite the availability-only scope.
Know when Idsecure gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Single unauthenticated network request crashes the whole process, so AV:N/AC:L/PR:N/UI:N with A:H and no confidentiality or integrity impact; matches the vendor 7.5.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
2DescriptionCVE.org
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure process.
Executive ViewAI
Control iD iDSecure, the platform used to manage physical access control and time-attendance at customer sites, can be forced offline by a single unauthenticated HTTP request on every build prior to 4.8.3.0, leaving doors, turnstiles, and credential validation dependent on manual fallback until the service is restarted. Because no credentials or user interaction are required and the trigger can be repeated at will, any network-reachable deployment represents an ongoing availability risk to physical security operations. This should be treated as a continuity-of-operations issue for facilities and security teams rather than a data-exposure incident, as no confidentiality or integrity impact has been identified.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any net
Exploit-DB