CVE-2025-49851 is a critical (CVSS 9.8 in the record) improper authentication flaw in ControlID iDSecure On-premises 4.7.48.0 and prior. An attacker can bypass authentication and gain permissions in the product. CISA's advisory lists version 4.7.50.0 as the release to update to.
What's affected
ControlID iDSecure On-premises versions 4.7.48.0 and prior, per the record and the CISA ICS advisory ICSA-25-175-05. CISA describes the product as vehicle control software.
CISA's advisory lists ControlID's update as iDSecure On-premises version 4.7.50.0, and says to contact ControlID for more information. Confirm the release with the vendor before you plan the change.
The same advisory covers two other flaws in the same versions: a server-side request forgery, CVE-2025-49852, and an SQL injection, CVE-2025-49853. Updating addresses all three, and an exposed instance carries all three risks at once.
One note on the numbers. CISA calculated a CVSS v3.1 base score of 7.5 for this CVE, with a vector that shows high confidentiality impact only. The 9.8 in the record does not match it. Read both before you set priority, but the update is the same either way.
How to check if you're exposed
Open the iDSecure application and read the version in its About or system information page. Anything at 4.7.48.0 or lower is affected. Then check whether the server is reachable beyond the network that needs it. From the server itself, list its listening ports:
netstat -ano | findstr LISTENING
Run that on the Windows host and compare the ports with your firewall rules. Confirm with your network team whether any of them are published to the internet.
What to do now
- Find every iDSecure On-premises installation, including those run by integrators or at remote sites.
- Update to 4.7.50.0 or later after confirming it with ControlID.
- Take the server off the internet. CISA advises minimizing network exposure for control systems and placing them behind firewalls, away from business networks.
- Where remote access is needed, use a VPN, and keep the VPN current.
- Review logs for logins you do not recognize, and check the user and permission lists for changes you did not make.
- Since the same versions are affected by SQL injection and SSRF, treat data held in the product as possibly read.
Why it matters
The weakness is CWE-287, improper authentication. A product meant to control who may enter a site decided too easily who the caller was. Attackers who pass that check gain permissions in the product, per the record.
Operational technology like this tends to sit unpatched because updates need planning around a live site. That is the reason to reduce exposure first and update second. The record's KEV flag is false.
Quick check
What version fixes CVE-2025-49851?
CISA's advisory lists iDSecure On-premises 4.7.50.0 as the update ControlID released. Confirm with the vendor.
Are there related CVEs?
Yes. The same advisory covers CVE-2025-49852 (SSRF) and CVE-2025-49853 (SQL injection) in the same versions.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
