What is the CVSS score of CVE-2025-13212?

CVE-2025-13212 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Aspera Console are affected by CVE-2025-13212?

CVE-2025-13212 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-13212?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Aspera Console CVE-2025-13212

EUVD-2025-208657 MEDIUM

Improper Control of Interaction Frequency (CWE-799)

2026-03-13 ibm

Denial Of Service IBM Aspera Console

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 17, 2026 - 15:49 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2025-208657

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 19:54 nvd

MEDIUM 5.3

DescriptionCVE.org

IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.

AnalysisAI

IBM Aspera Console versions 3.3.0 through 3.4.8 contain an improper rate-limiting vulnerability in the email service that allows authenticated users to trigger a denial of service condition. An attacker with valid credentials can abuse the email functionality by sending requests at excessive frequencies, exhausting service resources and rendering the email feature unavailable to legitimate users. This vulnerability requires authentication and does not provide confidentiality or integrity impact, resulting in a moderate CVSS score of 5.3.

Technical ContextAI

The vulnerability exists in IBM Aspera Console's email service component, which fails to implement adequate rate-limiting or request throttling mechanisms. This falls under CWE-799 (Improper Control of Interaction Frequency), a weakness category that encompasses scenarios where applications do not properly restrict the frequency or volume of interactions from users. The affected software is identified via CPE string cpe:2.3:a:ibm:aspera_console, spanning versions 3.3.0 through 3.4.8. The email service likely uses standard SMTP or internal mail relay mechanisms, but lacks authentication-based quotas or per-user request frequency controls that would prevent abuse by authenticated actors.

RemediationAI

Upgrade IBM Aspera Console to version 3.4.9 or later (specific version availability should be confirmed via IBM's security advisory). Organizations unable to patch immediately should implement compensating controls by restricting network access to the Aspera Console email service to trusted internal networks only, implementing authentication-based rate-limiting at a reverse proxy or WAF level to cap email service requests per authenticated user, and monitoring email service logs for unusual request frequency patterns. Enable multi-factor authentication on all Aspera Console administrative accounts to reduce the risk of compromised credentials being used for abuse.