CVE-2025-1044: Logsign Unified SecOps Platform authentication bypass in web service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required and a very high EPSS score make this an urgent pre-auth bypass on an internet-facing security platform.

What it is

The Logsign Unified SecOps Platform web service on TCP port 443 fails to properly implement its authentication algorithm, allowing attackers to bypass authentication entirely. Because the flaw is remotely reachable and requires no credentials, it exposes the platform's management interface to unauthenticated access. The record does not specify affected versions beyond a linked release note.

Impact

An unauthenticated attacker gains full access to the platform, with high confidentiality, integrity and availability impact per the CVSS vector. This can lead to compromise of security operations data and control over the appliance.

Attack surface

Reachable over the network via the web service on TCP port 443; no authentication is required and no user interaction is needed per the CVSS vector and description.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is very high at 0.75296 (99.5th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Apply the vendor fix referenced in the Logsign 6.4.32 release notes or later as soon as possible.
• Restrict network access to TCP port 443 on Logsign Unified SecOps Platform to trusted management networks only.
• Place the platform behind a VPN or authenticated reverse proxy where feasible.
• Monitor vendor advisories and ZDI-25-085 for updated guidance and affected version details.
• Audit platform accounts and configuration for signs of unauthorized changes.

Detection

• Review web server and application logs for requests to authentication endpoints that succeed without prior login or valid session tokens.
• Alert on anomalous administrative actions or configuration changes originating from unexpected source IPs.
• Baseline normal authentication flows and flag sessions created without a corresponding credential submission.
• Monitor for scanning or probing of TCP port 443 against Logsign instances from untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.