Vertica CVE-2025-12455

The CVSS 4.0 score of 5.1 indicates moderate severity with network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but user interaction is required (UI:A). The vector shows limited confidentiality impact (VC:L) and scope not changed. While the CVSS base score is moderate, real-world risk depends on several factors: (1) the vulnerability requires network access but no authentication, making it broadly accessible; (2) the observable response discrepancy enables automated brute-force attacks at scale; (3) user interaction requirement (UI:A) may be minimal depending on implementation; (4) KEV and POC status would elevate priority significantly if present; (5) Vertica is enterprise database infrastructure where credential compromise directly impacts data confidentiality. This is not a high-CVSS-but-low-real-risk issue—password brute-forcing against database management consoles represents substantial risk in production environments where accounts manage critical data access. Organizations should prioritize patching based on their Vertica deployment criticality and network exposure.

An attacker on the network conducts reconnaissance to identify Vertica management console endpoints accessible from their position. They systematically submit authentication requests with common usernames (e.g., 'admin', 'dba', 'vertica') combined with password lists, observing response timing or status code differences that reveal valid usernames. Once a valid username is identified through response discrepancies, the attacker accelerates password guessing against that account. If the console lacks rate-limiting and account lockout, they can attempt thousands of passwords over hours or days, eventually obtaining credentials to the database management system and gaining access to sensitive data or performing administrative changes. No exploit code or active exploitation in the wild may be required—the vulnerability enables straightforward, low-complexity brute-force methodology that scales easily.