Server-Side Request Forgery Vulnerability in ControlID iDSecure
CVE-2025-49852

8.7HIGH

Key Information:

Vendor

Controlid

Status
Idsecure On-premises
Vendor
CVE Published:
24 June 2025

What is CVE-2025-49852?

The ControlID iDSecure product, specifically versions 4.7.48.0 and earlier, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This flaw allows an unauthenticated attacker to send crafted requests from the server, potentially enabling unauthorized access to sensitive information hosted on other servers. Organizations using these versions should take immediate steps to secure their systems and mitigate potential risks associated with this vulnerability.

Affected Version(s)

iDSecure On-premises 0 <= 4.7.48.0

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-1...
government-resource

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Noam Moshe of Claroty Team82
.
CVE-2025-49852 : Server-Side Request Forgery Vulnerability in ControlID iDSecure