CVE-2026-92625
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates and relaunches the iDSecure service process via a generated batch script, allowing an attacker to hold the service in a continuous restart cycle.
Risk Assessment
An unauthenticated remote attacker can repeatedly call the endpoint, keeping the service in a continuous restart cycle and rendering it unavailable.
Recommendation
Update Control iD iDSecure to version 4.8.3.0 or later.
Other vulnerabilities in Control iD iDSecure
See all- CVE-2023-33369Critical
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
- CVE-2026-92626High
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/dguardintegration/dguardVersion endpoint dereferences DGuard integration login state that may be unset, raising an unhandled null reference exception in an async void method, which can terminate the iDSecure process.
- CVE-2023-33370High
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
- CVE-2023-33368Medium
In Control ID IDSecure versions 4.7.26.0 and prior, some API routes exist that exfiltrate sensitive information and passwords to users accessing these API routes.
Original NVD description (English source)
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service. The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS