PT-2025-26775 · Control Id · Control Id Idsecure

Noam Moshe · Published 2025-06-24 · Updated 2025-07-02 · CVE-2025-49853

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ControlID iDSecure On-premises versions 4.7.48.0 and prior

Description: The issue allows attackers to perform SQL injections, which could enable them to leak arbitrary information and insert arbitrary SQL syntax into SQL queries, giving them access to sensitive data and allowing them to manipulate SQL queries.

Recommendations: For ControlID iDSecure On-premises versions 4.7.48.0 and prior, update to a version later than 4.7.48.0 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-49853

Affected Products

Control Id Idsecure

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-49853 · Security Note
• https://osv.dev/vulnerability/CVE-2025-49853 · Vendor Advisory
• https://t.me/cvetracker/26973 · Telegram Post
• https://twitter.com/attritionorg/status/1940108138130416032 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1llaqyg/critical_flaws_in_controlid_software_threaten · Reddit Post
• https://cisa.gov/news-events/ics-advisories/icsa-25-175-05 · Note
• https://twitter.com/CveFindCom/status/1937596786861834686 · Twitter Post
• https://twitter.com/CVEnew/status/1937596266659152238 · Twitter Post
• https://t.me/cvenotify/127434 · Telegram Post