Improper Control of Generation of Code

CVE-2026-17561 is an unauthenticated code injection flaw in Logsign Unified SecOps Platform (SIEM) versions prior to 6.4.108. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tells the full story: a remote attacker can inject and execute arbitrary code on the Logsign appliance without any credentials, user interaction, or elevated complexity. This is the third wave of unauth-RCE-class bugs in Logsign — the 2024 ZDI disclosures (CVE-2024-5716 through CVE-2024-5722) established a pattern of missing authentication and command injection across the platform's API surface, and public exploit code already exists for those earlier chains.

The vendor's CRITICAL / 9.8 rating is technically accurate and, if anything, undersells the operational impact. CVSS doesn't account for *what the target does*. A SIEM appliance ingests logs from every tier of the environment, holds credentials or API tokens for dozens of log sources, and is the primary detection surface for the SOC. Gaining code execution here lets an attacker blind the SOC, exfiltrate months of security telemetry, and pivot laterally using the SIEM's privileged network position. The saving grace — and the only reason this isn't a mass-exploitation event — is that Logsign is a niche Turkish vendor with roughly 500 enterprise customers worldwide. If you don't run Logsign, this CVE is irrelevant to you. If you do, treat it as a five-alarm fire.

Why this verdict

• Unauth RCE with zero friction: AV:N/AC:L/PR:N/UI:N means any network-reachable instance is one HTTP request away from compromise. No credentials, no user interaction, no race condition.
• Role multiplier — SIEM / detection plane: Logsign is *exclusively* deployed as a SIEM. 100% of its installed base is a high-value-role target. Compromise yields: (a) SOC blinding via log/alert suppression, (b) credential harvesting from stored log-source integrations, (c) lateral pivot from SIEM's privileged network position. Blast radius: host → tenant → domain → fleet. This floors the verdict at CRITICAL per the role-multiplier rule.
• Proven attack-surface pattern: Logsign has a documented history of unauth RCE (7 ZDI CVEs in 2024, public exploits on GitHub, Nuclei templates). Researchers know this codebase and the API surface. A PoC for CVE-2026-17561 is likely days to weeks away.
• No compensating telemetry: SIEM appliances rarely run EDR agents, are typically not behind WAFs, and *are* the detection stack — meaning a compromise here can erase its own forensic evidence.

Why not higher?

9.8 is already the effective ceiling for a Scope:Unchanged vulnerability. The only vector that could push higher would be Scope:Changed (e.g., hypervisor escape), which does not apply here. The score and severity bucket are at maximum.

Why not lower?

Despite the tiny installed base (~500 customers), Logsign is canonically a high-value-role component (SIEM / detection plane). The role-multiplier hard rule floors the verdict at CRITICAL because ≥10% of installs (in fact, 100%) occupy the high-value role. The unauth/network/low-complexity attack vector provides zero friction to offset. Downgrading would require evidence that the majority of Logsign instances are unreachable *and* that the SIEM role doesn't apply — neither condition holds.

1. Restrict network access to the Logsign web UI immediately — Place the Logsign management interface behind a firewall rule or jump host that limits access to authorized SOC analyst IPs only. This is your highest-leverage control — if the attacker can't reach the web UI, the chain breaks at step 1. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL.
2. Deploy a reverse proxy with WAF rules in front of Logsign — If you cannot patch immediately, place a WAF (e.g., ModSecurity, Cloudflare WAF, AWS WAF) in front of the Logsign HTTPS endpoint with rules blocking code injection patterns in POST bodies. This is a partial mitigation — code injection payloads can be obfuscated. Deploy within 3 days.
3. Enable out-of-band alerting for SIEM health — Configure a separate monitoring system (e.g., Uptime Kuma, Nagios, PagerDuty heartbeat) to alert if Logsign stops ingesting logs or its web UI becomes unresponsive. This won't prevent compromise but ensures you detect SOC-blinding attempts. Deploy within 3 days.
4. Audit stored credentials in Logsign log-source configurations — Inventory all API keys, service accounts, and credentials stored in Logsign's log-source integrations. Rotate any that would provide lateral-movement capability if exfiltrated. Prioritize domain admin, cloud IAM, and database credentials.
5. Upgrade to Logsign 6.4.108 or later — This is the definitive fix. Apply within the noisgate remediation SLA of 90 days for CRITICAL, but realistically aim for the same maintenance window as your network access restriction — treat this as an emergency patch.

Run this script on the Logsign appliance itself (SSH as root) or from any host that can reach the Logsign API. Example: bash check_cve_2026_17561.sh 10.0.1.50. No special privileges needed beyond SSH access to the appliance or curl access to the API.

#!/usr/bin/env bash
# check_cve_2026_17561.sh — Check if Logsign SIEM is vulnerable to CVE-2026-17561
# Usage: bash check_cve_2026_17561.sh [LOGSIGN_HOST_OR_IP]
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-localhost}"
FIXED_VERSION="6.4.108"

echo "[*] Checking Logsign version on ${TARGET}..."

# Method 1: Check via local file if running on the appliance
if [ "$TARGET" = "localhost" ] || [ "$TARGET" = "127.0.0.1" ]; then
  for f in /opt/logsign/version /etc/logsign/version /opt/logsign/etc/version; do
    if [ -f "$f" ]; then
      INSTALLED_VERSION=$(cat "$f" | tr -d '[:space:]')
      echo "[*] Found version file: $f"
      echo "[*] Installed version: ${INSTALLED_VERSION}"
      # Compare versions
      if printf '%s\n' "$FIXED_VERSION" "$INSTALLED_VERSION" | sort -V | head -n1 | grep -qx "$FIXED_VERSION"; then
        echo "PATCHED — Logsign ${INSTALLED_VERSION} >= ${FIXED_VERSION}"
        exit 0
      else
        echo "VULNERABLE — Logsign ${INSTALLED_VERSION} < ${FIXED_VERSION} (CVE-2026-17561)"
        exit 1
      fi
    fi
  done
fi

# Method 2: Check via the web UI login page version string
VERSION_OUTPUT=$(curl -sk --max-time 10 "https://${TARGET}/api/settings/version" 2>/dev/null || \
                 curl -sk --max-time 10 "https://${TARGET}/version" 2>/dev/null || \
                 curl -sk --max-time 10 "https://${TARGET}/" 2>/dev/null | grep -oP '"version"\s*:\s*"\K[0-9.]+' || true)

if [ -z "$VERSION_OUTPUT" ]; then
  # Try extracting from HTML
  VERSION_OUTPUT=$(curl -sk --max-time 10 "https://${TARGET}/" 2>/dev/null | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)
fi

if [ -z "$VERSION_OUTPUT" ]; then
  echo "UNKNOWN — Could not determine Logsign version on ${TARGET}. Verify manually."
  exit 2
fi

echo "[*] Detected version: ${VERSION_OUTPUT}"

if printf '%s\n' "$FIXED_VERSION" "$VERSION_OUTPUT" | sort -V | head -n1 | grep -qx "$FIXED_VERSION"; then
  echo "PATCHED — Logsign ${VERSION_OUTPUT} >= ${FIXED_VERSION}"
  exit 0
else
  echo "VULNERABLE — Logsign ${VERSION_OUTPUT} < ${FIXED_VERSION} (CVE-2026-17561)"
  exit 1
fi

Sources

1. THREATINT — CVE-2026-17561 Detail
2. TheHackerWire — Critical Code Injection in Logsign SIEM
3. ZDI — Getting Unauthenticated RCE on Logsign (2024)
4. CCB Belgium — Logsign RCE Advisory
5. gh-ost00 — Logsign RCE Exploit + Nuclei Template
6. CyberSecurityNews — Logsign Unified SecOps RCE Vulnerabilities
7. Logsign Official Website