Idsecure
Monthly
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a pure availability impact with no credentials or user interaction required; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the vendor has released a fix.
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote attackers can terminate the Control iD iDSecure service by sending a single HTTP request to the /api/dguardintegration/dguardVersion endpoint, knocking the system offline until the process is restarted. All iDSecure builds prior to 4.8.3.0 are affected; the crash occurs when the DGuard integration login state is unset and an unhandled null-reference exception escapes from a fire-and-forget asynchronous routine. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) confirms a pure availability impact with no credentials or user interaction required; no public exploit code and no confirmed in-the-wild exploitation were identified at time of analysis, and the vendor has released a fix.
Unauthenticated repeated calls to the license-restart API in Control iD iDSecure versions prior to 4.8.3.0 allow any network-reachable attacker to hold the service in a continuous restart cycle, rendering the application unavailable. The exposed /api/license/restartService endpoint requires no credentials, no user interaction, and no non-default configuration to reach, and CVSS 3.1 scores the flaw 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) with high availability impact while confidentiality and integrity remain unaffected. No public exploit code has been identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV), though the single-request nature of the technique makes it straightforward to reproduce wherever the management interface is exposed; the practical limiting factor is network reachability of the iDSecure HTTP API.
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.