CVE-2026-92625— Control iD iDSecure Unauthenticated Denial of Service
Quick assessment
Affected
Control iD iDSecure
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Control iD iDSecure 在 4.8.3.0 之前的版本受到未经身份验证的拒绝服务（Denial of Service）漏洞影响。 /api/license/restartService 端点可以在未经身份验证的情况下访问，并会调用一个内部例程，该例程通过生成的批处理脚本终止 iDSecure 服务进程并重新启动它。未经身份验证的远程攻击者可以反复调用此端点，使服务陷入持续的重启循环，从而导致其不可用。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92625
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Control iD iDSecure Unauthenticated Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Control iD | iDSecure | 0 ~ 4.8.3.0 | - |
|
II. Public POCs for CVE-2026-92625
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92625
请登录查看更多情报信息。
Other References for CVE-2026-92625 (1)
IV. Related Vulnerabilities
Same vendor: Control iD
-
CVE-2026-92626
Control iD iDSecure Unauthenticated Denial of Service -
CVE-2025-2125
Control iD RH iD PDF Document companyId resource injection -
CVE-2025-2124
Control iD RH iD API change_password cross site scripting -
CVE-2023-6329
Control iD iDSecure passwordCustom Authentication Bypass -
CVE-2023-4392
Control iD Gerencia Web Cookie cleartext storage
Same weakness: CWE-306
-
CVE-2026-92720
Kubero through 3.1.1 Unauthenticated Notifications API Acces -
CVE-2026-92717
Covenant through 0.6 Missing Authentication on the CovenantH -
CVE-2026-61590
djust's observability endpoints are network-exposed: the loc -
CVE-2026-73173
Advantech EKI-1242EIMS V1.06.01 缺失认证漏洞 -
CVE-2026-40856
Config disclosure in T-Mobile 5G Box IDU routers
V. Comments for CVE-2026-92625
No comments yet