Description
A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-08-05
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in ESAFENET CDG allows manipulation of the keyid argument in the /CDGServer3/ukey/usbkey;logindojojs function, enabling attackers to inject unsanitized SQL statements. This can compromise database integrity or confidentiality, potentially leading to unauthorized data retrieval or modification.

Affected Systems

ESAFENET CDG products prior to the build dated 20260615 are affected. The vulnerability resides in the /CDGServer3/ukey/usbkey;logindojojs interface, and the specific function is not enumerated. No alternative versions are specified, so all releases up to that date are susceptible.

Risk and Exploitability

The assessed CVSS score of 6.9 indicates moderate risk. EPSS is not available, and the vulnerability has not been listed in the CISA KEV catalog. Because the flaw is exploitable remotely and publicly available exploits exist, adversaries can potentially drive unauthorized SQL queries against the backend database. The lack of a vendor response heightens the risk that affected installations remain exposed.

Generated by OpenCVE AI on August 5, 2026 at 02:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest ESAFENET CDG update released after 20260615 to patch the affected function.
  • If an update is unavailable, temporarily block or restrict access to the /CDGServer3/ukey/usbkey;logindojojs endpoint or enforce strict input validation on the keyid parameter to prevent SQL injection.
  • Monitor database logs for unusual query patterns and respond to any anomalous activity.
  • Conduct a security review of all exposed interfaces for similar injection points.

Generated by OpenCVE AI on August 5, 2026 at 02:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 05 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title ESAFENET CDG usbkey;logindojojs sql injection
First Time appeared Esafenet
Esafenet cdg
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:esafenet:cdg:*:*:*:*:*:*:*:*
Vendors & Products Esafenet
Esafenet cdg
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Esafenet Cdg
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-05T00:45:35.237Z

Reserved: 2026-08-04T16:12:17.471Z

Link: CVE-2026-18859

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-05T03:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')