Control iD iDSecure passwordCustom Authentication Bypass
97Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 65%
from disclosure to weapon835 days
Published on NVDNov 27
1st PoC+835d
metasploitNov 27
VulnCheck+714d
exploitation probability
65%top 1% of all CVEs
observed exploitation
yesVulnCheck
2 public exploit(s)
An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentication and act as an administrative user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Control iD · iDSecurepublic PoCs found — 2
githubgithub.com/itzvenom/CVE-2023-6329★ 1vulncheckvulncheck.com/xdb/98ad0501a981unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.