CVE-2026-92625: Control iD iDSecure Denial of Service Vulnerability

CVE-2026-92625 Overview

CVE-2026-92625 is an unauthenticated denial of service vulnerability affecting Control iD iDSecure access control software prior to version 4.8.3.0. The /api/license/restartService endpoint is exposed without authentication and triggers an internal routine that terminates the iDSecure service process before relaunching it through a generated batch script. A remote attacker can repeatedly call this endpoint to keep the service in a continuous restart cycle, preventing legitimate use. The flaw is tracked as a Missing Authentication for Critical Function weakness [CWE-306].

Critical Impact

Any unauthenticated network-adjacent attacker can render iDSecure permanently unavailable by looping requests to the restart endpoint.

Affected Products

• Control iD iDSecure versions prior to 4.8.3.0

Discovery Timeline

• 2026-09-16 - CVE-2026-92625 published to the National Vulnerability Database
• 2026-09-16 - Last updated in NVD database
• Tenable Research Advisory TRA-2026-56 - Public advisory released (Tenable Research Advisory TRA-2026-56)

Technical Details for CVE-2026-92625

Vulnerability Analysis

The iDSecure application exposes a REST endpoint at /api/license/restartService that is intended to restart the underlying Windows service. The endpoint does not enforce any authentication, authorization, or rate-limiting controls. When invoked, the handler kills the running iDSecure process and writes out a batch script that immediately relaunches it.

Because the restart routine tears down the process and reissues a launch command, each successful request produces a measurable service interruption. Chaining requests in a tight loop keeps the service in a perpetual terminate-and-restart state. During this window, access control workflows, badge readers, and integrated door hardware relying on iDSecure lose their backend availability.

Root Cause

The root cause is a missing authentication check on a security-sensitive administrative function [CWE-306]. Sensitive lifecycle operations such as service restart must be gated behind authenticated, authorized sessions. In affected versions, the endpoint is reachable by any client capable of sending HTTP requests to the iDSecure API port.

Attack Vector

Exploitation requires only network reachability to the iDSecure web API. No credentials, user interaction, or prior foothold are needed. An attacker sends repeated HTTP requests to /api/license/restartService, causing the service to enter a restart loop. The impact is limited to availability; confidentiality and integrity of stored data are not directly affected.

No verified exploit code is published. See the Tenable Research Advisory TRA-2026-56 for additional technical detail.

Detection Methods for CVE-2026-92625

Indicators of Compromise

• Repeated HTTP requests to the /api/license/restartService path from a single or small set of source addresses
• Frequent creation or execution of the batch script generated by the iDSecure restart routine
• Windows Service Control Manager events showing the iDSecure service stopping and starting in rapid succession
• Gaps in access control event logging that align with restart cycles

Detection Strategies

• Alert on any unauthenticated request reaching /api/license/restartService, especially at a rate exceeding normal administrative use
• Correlate high-frequency service stop and start events (Windows Event IDs 7036, 7040) for the iDSecure service with inbound API traffic
• Monitor for anomalous process creation of cmd.exe spawning the iDSecure launcher batch file from the service account

Monitoring Recommendations

• Forward iDSecure web server access logs and Windows service events to a centralized SIEM for correlation
• Baseline the frequency of legitimate service restarts and alert on deviations
• Track availability metrics on iDSecure to identify sustained unavailability windows

How to Mitigate CVE-2026-92625

Immediate Actions Required

• Upgrade Control iD iDSecure to version 4.8.3.0 or later, which addresses the missing authentication check
• Restrict network exposure of the iDSecure API to trusted management networks only
• Review web server and firewall logs for prior requests to /api/license/restartService from untrusted sources

Patch Information

Control iD resolved the vulnerability in iDSecure 4.8.3.0. Refer to the Tenable Research Advisory TRA-2026-56 for vendor and advisory details. Apply the vendor-supplied update as the primary remediation.

Workarounds

• Block external access to the /api/license/restartService endpoint at a reverse proxy or web application firewall until patching is complete
• Place the iDSecure server behind network segmentation that limits API access to authorized administrative hosts
• Apply rate limiting on the iDSecure API to reduce the effectiveness of restart-loop abuse

# Example reverse proxy rule to block the vulnerable endpoint
location /api/license/restartService {
    deny all;
    return 403;
}