CVE-2023-6329: Control iD iDSecure authentication bypass via passwordCustom login option

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, and public exploit material plus very high EPSS make this an urgent patch for any internet- or broadly reachable iDSecure deployment.

What it is

Control iD iDSecure v4.7.32.0 contains an authentication bypass in the login routine of iDS-Core.dll. A "passwordCustom" option lets an unauthenticated attacker compute valid credentials and log in as an administrative user. This gives full control of the access control platform without any prior access.

Impact

An attacker gains administrative access to iDSecure, allowing them to manage users, credentials and door or device configuration. That can translate into physical access control compromise, not just data exposure.

Attack surface

Reachable over the network via the iDSecure login interface; the CVSS vector shows no privileges and no user interaction required. Any host that can reach the login endpoint can attempt the bypass.

Exploitation

Not listed in CISA KEV, but EPSS is 0.64996 (99.2nd percentile) and the only reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Upgrade iDSecure to a version later than v4.7.32.0 that fixes the authentication bypass; confirm the fixed build with Control iD.
• If patching is not immediately possible, restrict network access to the iDSecure login interface to trusted management networks only.
• Rotate administrative credentials and review accounts for unauthorized additions or changes.
• Monitor iDSecure and iDS-Core.dll logs for unexpected administrative logins, especially from unfamiliar source addresses.

Detection

• Alert on successful administrative logins to iDSecure from unexpected or external source IPs.
• Hunt for authentication attempts that use or reference the passwordCustom option in iDSecure logs or request data.
• Review iDSecure audit logs for new admin accounts, permission changes or configuration edits made outside normal change windows.
• Correlate iDSecure login events with network flow data to spot access from hosts that do not normally manage the platform.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.