Aspera Console CVE-2025-13212

While the CVSS base score of 5.3 (with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) indicates moderate severity, the real-world risk must be contextualized. The attack requires network access (AV:N) and low complexity (AC:L), but critically requires prior authentication (PR:N appears contradictory in the vector but the description confirms authentication is needed). The vulnerability results only in availability impact (denial of service to email functionality), not confidentiality or integrity compromise. Without EPSS probability data, KEV active exploitation confirmation, or public proof-of-concept availability mentioned in this dataset, the practical exploitability remains constrained to authenticated insider threats or compromised accounts. This is a real but lower-priority issue compared to unauthenticated remote code execution vulnerabilities; organizations should remediate during normal patching cycles rather than as emergency incidents.

An authenticated Aspera Console user with malicious intent or a compromised service account sends a high volume of email service requests in rapid succession—for example, triggering email notifications or sending test emails in a loop. Because the email service lacks request frequency controls, these requests overwhelm the email queue or mail relay, causing the service to become unresponsive and denying email functionality to all legitimate users until an administrator intervenes or the attack ceases. The attack requires no special tools beyond standard API calls or web interface interaction and can be executed over the network, making it feasible for internal threats or attackers with valid credentials.