CVE-2025-49851 Improper Authentication in ControlID iDSecure On-premises

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...

CVE-2025-49851

The CVE-2025-49851 entry concerns ControlID iDSecure On-premises, affected versions 4.7.48.0 and prior. The root cause is an improper authentication vulnerability that could let an attacker bypass authentication and gain permissions in the product. Public sources in the connected documents corrob...

CVE-2025-49851 Improper Authentication in ControlID iDSecure On-premises

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...

CISA Releases Eight Industrial Control Systems Advisories

CISA released eight Industrial Control Systems ICS advisories on June 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-175-01 Kaleris Navis N4 Terminal Operating System ICSA-25-175-02 Delta Electronics...

CVE-2025-49852: Server-Side Request Forgery (SSRF)

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers...

CVE-2025-49851: Improper Authentication

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product...

Control iD iDSecure On-premises 代码问题漏洞

Control iD iDSecure On-premises is an access control software from Control iD, a Brazilian company, used to manage personnel and vehicle access. A code issue vulnerability exists in Control iD iDSecure On-premises version 4.7.48.0 and prior versions, which stems from server-side request forgery a...

PT-2025-26775 · Control Id · Control Id Idsecure

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue allows attackers to perform SQL injections, which could enable them to leak arbitrary information and insert arbitrary SQL syntax into SQL queries, giving them...

Control iD iDSecure On-premises 注入漏洞

Control iD iDSecure On-premises is an access control software from Control iD, a Brazilian company, used to manage personnel and vehicle access. A SQL injection vulnerability exists in Control iD iDSecure On-premises version 4.7.48.0 and prior versions, which originates from SQL injection and cou...

CVE-2025-49853: Improper Neutralization of Special Elements used in an SQL Command

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries...

PT-2025-26772 · Control Id · Control Id Idsecure

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior Description: The issue is related to an Improper Authentication vulnerability, which could allow an attacker to bypass authentication and gain permissions in the product. This poses a...

Control iD iDSecure On-premises 授权问题漏洞

Control iD iDSecure On-premises is an access control software from Control iD, a Brazilian company, used to manage personnel and vehicle access. An authorization issue vulnerability exists in Control iD iDSecure On-premises version 4.7.48.0 and prior versions, which stems from improper...

CVE-2023-33370

An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service...

CVE-2023-33367

A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution...

CVE-2023-2044

A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the...

CVE-2023-6329

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative use...

Control ID IDSecure Authentication Bypass

class MetasploitModule 'Control iD iDSecure Authentication Bypass CVE-2023-6329', 'Description' = %q This module exploits an improper access control vulnerability CVE-2023-6329 in Control iD iDSecure 'Michael Heinzl', MSF Module 'Tenable' Discovery and PoC , 'References' = 'CVE', '2023-6329',...

The vulnerability of the iDSecure access control system stems from deficiencies in the authentication process. This allows attackers to bypass the authentication procedures, gain unauthorized access to protected information, and increase their privileges.

The vulnerability of the iDSecure access control system is related to deficiencies in the authentication process when processing the passwordCustom parameter for the uploaded iDS-Core.dll library. Exploiting this vulnerability allows an attacker to bypass the authentication process, gain...

CVE-2023-6329

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative use...

CVE-2023-6329

An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative use...