CVE-2023-33369
📋 TL;DR
A path traversal vulnerability in Control ID IDSecure 4.7.26.0 and earlier allows attackers to delete arbitrary files on the system filesystem. This can cause denial of service by deleting critical system files. Organizations using affected IDSecure versions for access control systems are impacted.
💻 Affected Systems
- Control ID IDSecure
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical OS files, rendering the access control system inoperable and potentially affecting physical security operations.
Likely Case
Denial of service through deletion of application or configuration files, disrupting access control functionality until restoration.
If Mitigated
Limited impact with proper network segmentation and file permission controls preventing critical file deletion.
🎯 Exploit Status
Path traversal vulnerabilities typically have low exploitation complexity; unauthenticated access increases risk.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 4.7.26.0
Vendor Advisory: https://www.controlid.com.br/en/access-control/idsecure/
Restart Required: Yes
Instructions:
1. Contact Control ID for updated version. 2. Backup current configuration. 3. Install updated version. 4. Restart IDSecure service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate IDSecure system from untrusted networks to limit attack surface.
File Permission Hardening
windowsRestrict write permissions on critical system directories.
icacls C:\Windows\System32 /deny Everyone:(OI)(CI)(W)
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to IDSecure system
- Monitor file deletion events in system logs and set up alerts for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check IDSecure version in application interface or configuration files; if version is 4.7.26.0 or earlier, system is vulnerable.Check Version:
Check IDSecure web interface or configuration files for version informationVerify Fix Applied:
Verify installed version is newer than 4.7.26.0 and test file deletion functionality is properly restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in Windows Event Logs
- IDSecure application logs showing path traversal attempts
Network Indicators:
- HTTP requests with '../' sequences to IDSecure endpoints
- Unusual traffic patterns to IDSecure system
SIEM Query:
source="windows" EventID=4663 TargetObject="*\..\*" | where TargetObject contains "idsecure"