Assaabloy vulnerabilities
We track 8 vulnerabilities in Assaabloy products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on June 24, 2025.
Latest Assaabloy vulnerabilities
- 9.1 Critical severity
iDSecure On-premises: Improper Neutralization of Special Elements used in an SQL Command
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.
- 7.5 High severity
iDSecure On-premises: Server-Side Request Forgery
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.
- 9.8 Critical severity
iDSecure On-premises: Improper Authentication
ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.
- 9.8 Critical severity
Control Id Idsecure: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution.
- 9.8 Critical severity
Control Id Idsecure: Use of Hard-coded Credentials
Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication.
- 7.5 High severity
Control Id Idsecure: Improper Handling of Exceptional Conditions
An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service.
- 9.1 Critical severity
Control Id Idsecure: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service.
- 9.8 Critical severity
RHiD: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. I