Critical Authentication Bypass Vulnerabilities in Logsign Unified SecOps Platform Allow Remote Attacks

A severe security vulnerability identified as CVE-2025-1044 has been disclosed in the Logsign Unified SecOps Platform, a widely used software for security operations. This flaw is rated with a CVSS score of 9.8, posing a critical threat which allows remote attackers to bypass authentication without requiring any credentials.

Logsign Vulnerability Remote Attackers to Bypass Authentication

The vulnerability resides in the web service of the Logsign Unified SecOps Platform, which listens on TCP port 443 by default. The issue stems from improper implementation of the authentication algorithm, enabling attackers to bypass authentication mechanisms entirely. Unauthorized users can exploit this flaw by sending specially crafted HTTP requests to the server on port 443, processing these requests as legitimate without adequate authentication checks. Attackers do not require prior authentication or user interaction, making it a significant risk for organizations using the affected platform. Logsign has released an update (version 6.4.32) addressing this critical vulnerability. Users are strongly advised to upgrade their systems immediately. Additional security measures include restricting access to TCP port 443 through firewalls, enforcing multi-factor authentication (MFA), and monitoring system logs for suspicious activity related to unauthorized access attempts.

Microsoft Accounts Authentication Bypass Vulnerability

Image courtesy of Microsoft Microsoft has issued a security advisory for CVE-2025-21396, a critical authentication bypass vulnerability that could allow attackers to spoof credentials and gain unauthorized access to Microsoft accounts. This vulnerability is linked to CWE-290, which affects authentication mechanisms relying on insufficient or flawed validation methods. The issue arises from improperly designed authentication mechanisms that fail to robustly validate incoming requests. Cybersecurity experts recommend that users and organizations swiftly address this issue by applying relevant updates and following Microsoft's guidance. Attackers might exploit the vulnerability through techniques such as IP spoofing, DNS spoofing, and malformed or manipulated requests. Microsoft has released patches addressing the root cause of CVE-2025-21396. Preventive steps include adopting stronger authentication mechanisms, monitoring networks for anomalies, and enabling logging to maintain detailed records of authentication attempts.

Getting Unauthenticated Remote Code Execution on the Logsign Unified SecOps Platform

Image courtesy of Logsign The Trend Micro Zero Day Initiative (ZDI) has reported multiple vulnerabilities in the Logsign Unified SecOps Platform. The critical vulnerabilities include an authentication bypass (CVE-2024-5716) and a post-authentication command injection (CVE-2024-5717). The authentication bypass vulnerability arises from the lack of rate limiting on the password reset feature, allowing attackers to brute-force the password reset code and gain unauthorized access to accounts, including the default “admin” account. The command injection vulnerability allows authenticated users to execute arbitrary commands on the server as root due to improper validation of user input before it is passed to a system shell command. This vulnerability can be combined with the authentication bypass to achieve remote, unauthenticated code execution. Logsign has acknowledged these vulnerabilities and released a patch (version 6.4.8) addressing these and other related issues. Organizations using Logsign should prioritize updating to the latest version and implementing additional security measures such as rate limiting and MFA.

Call to Action

Explore how GrackerAI can enhance your cybersecurity marketing strategies by transforming security news into actionable insights. With GrackerAI's AI-powered platform, you can effectively monitor emerging threats and produce relevant content that resonates with cybersecurity professionals. Learn more about our offerings at GrackerAI.