CVE-2026-18859 in CDG
Summary
by MITRE • 08/05/2026
A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability resides within the ESAFENET CDG software version 20260615 and earlier, specifically targeting an unknown function within the file structure located at /CDGServer3/ukey/usbkey;logindojojs. The flaw represents a critical sql injection vulnerability that arises from improper handling of the keyid argument parameter. Attackers can manipulate this specific input field to execute malicious sql commands against the underlying database system, potentially gaining unauthorized access to sensitive information or compromising the entire database infrastructure.
The technical exploitation of this vulnerability occurs through remote attack vectors, meaning that malicious actors do not require physical access to the target system to carry out their operations. This remote exploit capability significantly increases the threat surface and potential impact of the vulnerability. The availability of a publicly accessible exploit further compounds the risk, as it removes the barrier to entry for attackers who may not possess advanced technical skills. The vulnerability's classification aligns with common weakness enumeration CWE-89 which specifically addresses sql injection flaws in software applications.
The operational impact of this vulnerability extends beyond simple data theft, potentially enabling complete system compromise through database manipulation. Attackers could leverage the sql injection to extract confidential information, modify or delete critical database records, or even escalate privileges within the application environment. The fact that the vendor was contacted early in the disclosure process without receiving any response indicates a potential lack of proper vulnerability management procedures or security oversight within the organization responsible for maintaining this software.
Security professionals should immediately implement network monitoring to detect exploitation attempts targeting this specific vulnerability. The recommended mitigation strategies include applying immediate patches if available, implementing input validation controls to sanitize all user-supplied data including the keyid parameter, and employing web application firewalls to filter suspicious sql injection patterns. Additionally, organizations should conduct comprehensive security assessments of all ESAFENET CDG installations and consider network segmentation to limit potential lateral movement if exploitation occurs. The vulnerability's presence in a usb key authentication system particularly raises concerns about supply chain security and the potential for attackers to compromise physical access controls through digital means.