CVE-2026-92625: Control iD iDSecure Unauthenticated Denial of Service
Control iD iDSecure versions prior to 4.8.3.0 are affected by an unauthenticated Denial of Service.
The /api/license/restartService endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it by way of a generated batch script. An unauthenticated remote attacker can call this endpoint repeatedly to hold the service in a continuous restart cycle, rendering it unavailable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
iDSecureto a version that resolves this vulnerability.Fixed in 4.8.3.0 - Configuration
Restrict access so the /api/license/restartService endpoint is not reachable without authentication.
iDSecure /api/license/restartService Authentication requirement = required
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
iD iDSecure versions earlier than 4.8.3.0 are affected if an attacker can reach the /api/license/restartService endpoint over the network. Exploitation does not require authentication or user interaction.
What does an attacker need to do to cause an outage?
An attacker only needs to repeatedly send requests to the unauthenticated /api/license/restartService endpoint. Each request triggers termination and relaunch of the iDSecure service, allowing the attacker to keep it in a restart cycle.
What is the operational impact of exploitation?
The iDSecure service can be rendered unavailable through a continuous restart cycle. The provided information describes an availability impact and does not indicate confidentiality or integrity impact.