CVE-2025-49852 - CVE House

Status published High CVE-2025-49852

Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises

8.7 CVSS

Vulnerability Description

ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-49852

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Noam Moshe of Claroty Team82

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-175-05

More from ControlID

View All →

CVE-2025-49853

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises

Critical 9.3

CVE-2025-49851

Improper Authentication in ControlID iDSecure On-premises

High 8.7

Affected Vendor

ControlID

View all reports →

Affected Software

iDSecure On-premises

Vulnerable Versions:

Timeline

Official Publish: June 24th, 2025

Last Modified: June 27th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1213 Data from Information Repositories

Collection

T1005 Data from Local System