by Kastro
Paper/Archive/CVE-2025-49853

CVE-2025-49853

ControlID iDSecure On-premises — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises

EPSS 0.5%CVSS 9.3
critical.is priorityof 100
36
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 41.6.416 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.

Affected

ProductAffectedFixed inSource
iDSecure On-premises≤ 4.7.48.0–CNA

Scores by source

icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
icscert (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcisa.gov/news-events/ics-advisories/icsa-25-175-05