Multiple vulnerabilities reported in ControlID iDSecure vehicle access control systems
Take action: If you use ControlID iDSecure On-Premises access control software, check if it's accessible from the internet. If it is, make sure it's isolated from the internet and accessible only from trusted networks as much as possible Then plan a quick update to version 4.7.50.0. This system controls physical access to your facilities, so breaching it may get criminals access to your premises.
Learn More
ControlID is reporting multiple security vulnerabilities in its iDSecure On-Premises access control software. Successful exploitation could allow attackers to bypass authentication mechanisms, retrieve sensitive information, leak arbitrary data, or perform SQL injections against backend databases.
ControlID, a Brazilian technology company founded in 2006 and now part of the ASSA ABLOY Group, specializes in developing hardware and software solutions for electronic security, commercial automation, and human resources management. ControlID's iDSecure On-Premises platform serves as an access control solution that enables organizations to manage both vehicle and personnel access across facilities.
Vulnerabilities summary:
- CVE-2025-49853 (CVSS score 9.3) - SQL Injection that allows attackers to perform SQL injections that can leak arbitrary information and insert malicious SQL syntax into database queries. The flaw enables unauthorized access to sensitive database contents, including potentially access logs, user credentials, biometric data, and facility security configurations.
- CVE-2025-49851 (CVSS score 8.7) - Improper Authentication that allows attackers to bypass authentication mechanisms and gain unauthorized permissions within the iDSecure platform. The flaw enables remote attackers to potentially escalate privileges and perform actions reserved for legitimate users without requiring valid credentials.
- CVE-2025-49852 (CVSS score 8.7) - Server-Side Request Forgery that allows unauthenticated attackers to retrieve information from other servers by manipulating server requests. Attackers can exploit this weakness to cause the iDSecure system to communicate with arbitrary internal or external resources, potentially leading to data exfiltration or facilitating lateral movement within organizational networks.
The vulnerabilities affect all installations of ControlID iDSecure On-Premises Version 4.7.48.0 on Windows and Linux platforms.
Organizations using iDSecure On-Premises for managing vehicle access are highly exposed since the platform typically integrates with gate controllers, barrier systems, and automated parking management infrastructure. A successful attack could potentially allow unauthorized vehicle access, manipulation of parking space allocations, or disruption of automated vehicle management systems. S
ControlID has release iDSecure On-Premises Version 4.7.50.0, which addresses all three identified security flaws. Organizations running vulnerable versions should prioritize upgrading to the patched version.
