CVE-2026-17561 PUBLISHED

Unauthenticated RCE in Innotim Software's Logsign SIEM

Assigner: TR-CERT
Reserved: 27.07.2026 Published: 31.07.2026 Updated: 31.07.2026

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection.

This issue affects Logsign SIEM: before 6.4.108.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 9.8

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Innotim Software, Telecommunications and Consulting Trade Ltd. Co.
Product	Logsign SIEM
Versions	Default: unaffected affected from 0 to 6.4.108 (excl.)

Credits

Berk İmran finder

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0717

Problem Types

CWE-94 Improper Control of Generation of Code ('Code Injection') CWE

Impacts

CAPEC-242 Code Injection