CVE-2026-92625 in iDSecure
Summary
by MITRE • 09/16/2026
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Control iD iDSecure versions prior to 4.8.3.0 represents a critical availability risk stemming from an unauthenticated Denial of Service condition within the application's license management subsystem. This flaw specifically targets the /api/license/restartService endpoint, which is designed to facilitate service restarts but lacks any form of authentication or access control verification. The absence of security checks allows remote attackers who can reach this network interface to trigger internal routines that forcibly terminate and subsequently relaunch the iDSecure service process through a generated batch script mechanism. This architectural oversight transforms a routine administrative function into an attack vector capable of disrupting operational continuity without requiring valid credentials, thereby violating fundamental principles of secure system design regarding privilege separation and access control.
From a technical perspective, the exploitation involves sending repeated HTTP requests to the vulnerable endpoint. Each request initiates a cycle where the service process is killed and then restarted via external script execution. This operation consumes significant system resources including CPU cycles for process management and memory allocation during startup sequences. By maintaining a high frequency of these restarts, an attacker can create a continuous loop that prevents the application from reaching a stable operational state. The resulting instability effectively renders the iDSecure service unavailable to legitimate users, leading to a complete loss of functionality for any dependent systems or services relying on this platform. This behavior aligns with CWE-787 Improper Access Control and CWE-400 Uncontrolled Resource Consumption, as the system fails to restrict access to sensitive administrative functions and allows an external actor to exhaust service availability through repetitive triggering of resource-intensive operations.
The operational impact of this vulnerability is severe for organizations deploying iDSecure in production environments where high availability is required. Since the endpoint is reachable without authentication, any entity with network connectivity to the affected system can exploit it. This could lead to extended downtime periods during which security monitoring, access control enforcement, or other critical functions provided by the software are suspended. In scenarios involving physical security systems integrated with iDSecure, such as door controllers or surveillance feeds, this outage may compromise physical safety and operational integrity. Furthermore, if the service restarts fail due to resource exhaustion or configuration errors triggered by rapid cycling, it could lead to data corruption or require manual intervention for recovery, increasing mean time to repair and operational costs.
Mitigation strategies primarily involve upgrading to version 4.8.3.0 or later where this issue has been addressed through the implementation of proper authentication mechanisms on administrative endpoints. Until an upgrade is feasible, organizations should implement network-level controls such as firewall rules or access control lists that restrict traffic to the /api/license/restartService endpoint exclusively from trusted management IP addresses. Additionally, deploying web application firewalls with rate-limiting capabilities can help mitigate the impact by detecting and blocking excessive request patterns indicative of a denial-of-service attack. Security monitoring should also be enhanced to detect unusual spikes in service restart events or abnormal network traffic directed at license-related API endpoints. This vulnerability is categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service, reflecting its nature as an attempt to make a targeted computing resource unavailable to its intended users through abuse of system functionality rather than traditional overload attacks.