CVE-2025-1044 is a critical authentication bypass, scored 9.8, in the Logsign Unified SecOps Platform web service. No login is needed to trigger it. Logsign has issued an update, and the ZDI advisory points to the version 6.4.32 release notes. Confirm and apply it.
What's affected
The Zero Day Initiative advisory ZDI-25-085, published on 5 February 2025, describes an authentication bypass in the Logsign Unified SecOps Platform. The flaw is in the web service, which listens on TCP port 443 by default. It results from the lack of a proper implementation of the authentication algorithm, and no authentication is required to use it.
The advisory says Logsign has issued an update to correct the vulnerability and links to the vendor's release notes for version 6.4.32. I could not read that vendor page, which sits behind a browser check, so confirm the fixed version in Logsign's own notes before you rely on it. The record does not list affected version ranges.
Per the advisory timeline, the issue was reported to the vendor on 26 September 2024 and publicly released on 5 February 2025. The record does not mark this CVE as known exploited.
How to check if you're exposed
Log in to your Logsign appliance and note the installed version from the product's about or system information page. Compare it to the release notes for 6.4.32 on Logsign's support site. If you run an earlier release, treat it as exposed until the vendor says otherwise.
Then check reach. The vulnerable service listens on TCP 443 by default, so list every network that can connect to that port on the platform. From a host outside the management network, test whether the address answers. For a SIEM or security operations platform the answer should be that only administrators and log sources on trusted segments can reach it.
Finally, review your appliance access logs and authentication audit trail for sessions that do not match a known user login, covering the months since September 2024.
What to do now
- Find every Logsign Unified SecOps Platform installation, including test and disaster recovery copies.
- Read the version 6.4.32 release notes and upgrade to that release or a later one.
- Until the upgrade is complete, limit access to port 443 to administrators and required log sources using firewall rules or a VPN.
- Review authentication logs for unfamiliar sessions, and check the platform for new accounts, API keys or changed rules.
- If you find suspicious activity, rotate credentials and API keys that the platform stores, such as those used for integrations.
- Record the upgrade and the review in your change log.
Why it matters
The weakness is CWE-287 (improper authentication). Authentication is the check that stops strangers from using the system. When it is implemented incorrectly, the rest of the access controls sit behind a door that does not lock.
A security operations platform is a particularly sensitive target. It collects logs from across the estate, holds detections and response playbooks, and often stores credentials for integrations. Anyone who gets in can read what you know about your own environment, and may be able to tamper with alerts. That is why a 9.8 here deserves more urgency than the number alone.
The fix is an upgrade, and the interim step is to shrink the set of hosts that can reach the web service. Neither takes long.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does exploiting CVE-2025-1044 need a login?
No. The ZDI advisory says authentication is not required to exploit it.
Which version fixes it?
The ZDI advisory links to Logsign's version 6.4.32 release notes as the update. Confirm the details in the vendor's notes, as the affected range is not listed in the record.
Sources
- ZDI advisory ZDI-25-085
- Logsign 6.4.32 release notes, referenced by the record (not readable when reviewed)
- NVD record for CVE-2025-1044
Last reviewed: 19 October 2026.
