CVE-2025-62189: logstare collector before 2.4.2 (exclusive); +2 more affected products

Affected technology

logstare collector · before 2.4.2 (exclusive)
secuavail

LogStare Collector (for Windows) · 2.4.1 and earlier
LogStare Inc.

LogStare Collector (for Linux) · 2.4.1 and earlier
LogStare Inc.

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says if exploited, a non-administrative user may create a new user account by sending a crafted HTTP request. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.