The vulnerability in Logsign SIEM arises from improper control over code generation, allowing an attacker to inject and execute arbitrary code. This flaw, classified as CWE‑94, enables full remote code execution without authentication, meaning any user able to reach the affected component can run arbitrary commands with the privileges of the SIEM process. The result is a compromise of confidentiality, integrity, and availability, potentially giving control of the entire SIEM deployment. The vulnerability is reported as affecting all versions prior to 6.4.108.

The affected product is Innotim Software's Logsign SIEM, specifically all releases before version 6.4.108. Users running older builds should identify their version and plan remediation.

With a CVSS base score of 9.8 the flaw is considered critical. The EPSS score of less than 1% indicates low current exploitation probability, but the lack of prior KEV listing does not diminish the potential impact. The best‑practice assessment is that an unauthenticated attacker can reach the vulnerable interface, likely via exposed management ports or web endpoints, and execute code directly on the host. Attackers need network access to the SIEM and no specific user credential. Once exploited, the attacker can execute arbitrary commands or install persistence mechanisms.