CVE-2025-1044: Logsign Unified SecOps Platform Authentication Bypass Vulnerability
First published: Tue Feb 11 2025(Updated: )
Logsign Unified SecOps Platform Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 443 by default. The issue results from the lack of proper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25336.
Credit: zdi-disclosures@trendmicro.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Logsign Unified SecOps Platform | ||
| Logsign Unified SecOps Platform | ||
| Logsign Unified SecOps Platform | <6.4.32 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-1044?
CVE-2025-1044 is classified as a high severity vulnerability due to its potential to allow remote attackers to bypass authentication.
How do I fix CVE-2025-1044?
To mitigate CVE-2025-1044, update to the latest version of the Logsign Unified SecOps Platform where the vulnerability is patched.
What is affected by CVE-2025-1044?
CVE-2025-1044 affects installations of the Logsign Unified SecOps Platform that do not have the necessary patches applied.
Can CVE-2025-1044 be exploited remotely?
Yes, CVE-2025-1044 can be exploited remotely as it allows attackers to bypass authentication without needing access to the system.
Is authentication required to exploit CVE-2025-1044?
No, authentication is not required to exploit CVE-2025-1044, making it particularly dangerous.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/references
- agent/type
- agent/title
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-25-085
- alias/ZDI-CAN-25336
- alias/CVE-2025-1044
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/source
- agent/author
- agent/tags
- vendor/logsign
- canonical/logsign unified secops platform