CVE-2018-19589

CVE-2018-19589 describes an Incorrect Access Control vulnerability in the PKCS11 R2 provider of Utimaco CryptoServer HSM products, specifically affecting securityserver_cse and its firmware. An authenticated Security Officer can retrieve attributes and delete private keys stored externally, leading to a denial of service for all keys configured with external storage. This medium-severity vulnerability (CVSS 6.5) has a network attack vector and low attack complexity, potentially enabling a "reverse ransomware" scenario where an attacker denies access to keys while retaining encrypted copies. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.