Getting Unauthenticated Remote Code Execution on the Logsign Unified SecOps Platform

Trend Micro ZDI acquired reports of multiple vulnerabilities in the Logsign Unified SecOps Platform that allow attackers to bypass authentication (CVE-2024-5716) by abusing the password reset mechanism and, when chained with a second flaw, achieve remote unauthenticated code execution via HTTP; the advisory describes the affected Python-based web server, API exposure, and the risk posed to deployments of Logsign.