Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)
Source SANS ISC Handlers Diary
Rated by Threat Radar
Data as of 07/31/2026, 01:30:40 UTC
What to do
AI-suggested
In the absence of official fixes, users should immediately change all default passwords to strong, unique credentials and review system configurations to mitigate SQL Injection and XSS vulnerabilities. Monitoring for updates from ESAFENET regarding security patches is recommended.
Description
ESAFENET&#;x26;#;39;s CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public.
Impact
The presence of default passwords and known vulnerabilities like SQL Injection and XSS can allow unauthorized access to the system, potentially leading to data leakage or compromise of the document management system. The use of well-known default credentials significantly lowers the barrier for attackers to gain access. However, no confirmed exploits in the wild are reported at this time.
Summary
The ESAFENET CDG 3 Document Management System has been observed in scanning activity targeting weak login credentials, specifically well-known default passwords. The product is known to have multiple basic vulnerabilities such as SQL Injection and XSS. Exploit scripts leveraging these default passwords have been publicly available since at least 2023. The scanning activity follows prior disclosures of cross-site scripting vulnerabilities. No vendor advisories or patch information are provided in the source data.