EUVD-2026-80804
GHSA-8hjh-385q-g4vq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Single unauthenticated network request crashes the whole process, so AV:N/AC:L/PR:N/UI:N with A:H and no confidentiality or integrity impact; matches the vendor 7.5.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
Lifecycle Timeline
3DescriptionCVE.org
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception. The exception is thrown from an asynchronous method that returns void, so it is not observed by a caller and can terminate the iDSecure process.
AnalysisAI
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable when the attacker can send an HTTP request to the /api/dguardintegration/dguardVersion endpoint of a Control iD iDSecure instance running a version prior to 4.8.3.0 and the DGuard integration login state is unset (the null-dereference precondition). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, well-scored remote unauthenticated Denial of Service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Control iD has released a vendor patch, so the primary fix is to upgrade iDSecure to version 4.8.3.0 or later (the first release outside the '< 4.8.3.0' affected range); see the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-56 for details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every iDSecure deployment and record its exact build number, flagging any instance that is reachable from untrusted or broad corporate networks; for systems that cannot be upgraded same-day, block external and unnecessary internal access to the /api/dguardintegration/dguardVersion endpoint and the DGuard integration API at the firewall or reverse proxy, and confirm that restart procedures and manual access fallbacks are documented and tested. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any net
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today