IBM Aspera Orchestrator CVE-2025-13148

Requires a valid authenticated session on IBM Aspera Orchestrator version 4.0.0 through 4.1.0 (PR:L); the attacker needs an existing low-privilege account but does NOT need to know the target user's current password, which is the core defect. Exploitation is network-reachable with no user interaction and no special non-default configuration implied by the advisory. The limiting factor is the authentication requirement - external unauthenticated attackers cannot exploit this directly, so real-world risk is highest in environments with many provisioned users, shared accounts, or exposed self-service portals.

This is a moderate-severity integrity flaw (CWE-620, Unverified Password Change) with the IBM-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). The signals are internally consistent and point to a real but bounded risk: the attacker must already be an authenticated, low-privileged user (PR:L), but once authenticated the attack is network-reachable (AV:N), low-complexity (AC:L), requires no user interaction (UI:N), and yields high integrity impact (I:H) by letting them reset any other user's password - enabling account takeover, including potentially higher-privileged accounts. Exploitation signals are cool: EPSS is 0.28% (18th percentile), there is no CISA KEV listing, and no public exploit has been identified, so this is not evidence of active or widespread exploitation. The main caveat is that the raw description understates downstream impact - resetting an admin's password could effectively escalate privileges, which the base C:N/A:N vector does not capture; treat the practical impact as account takeover rather than a narrow integrity write. The 'Information Disclosure' tag conflicts with the CVSS vector (C:N), which indicates no confidentiality impact - the true nature is unauthorized account/password modification.

An attacker who holds any valid low-privilege account on IBM Aspera Orchestrator (4.0.0-4.1.0) issues a password-change request targeting another user - such as an administrator - without supplying that user's current password. The attacker sets the victim's password to a value they control and then logs in as the victim, achieving account takeover and potential privilege escalation. No public exploit code has been identified, but the low attack complexity makes exploitation straightforward for any authenticated user.