IBM Aspera Orchestrator CVE-2025-13214

Exploitation requires an authenticated session to IBM Aspera Orchestrator at a low privilege level (CVSS PR:L) - the attacker must possess valid, even limited, application credentials or a valid session, so this is not exploitable by fully anonymous internet attackers. Beyond authentication, no special non-default configuration, platform, or user-interaction requirement is indicated (AC:L, UI:N), meaning any reachable instance running the affected versions 4.0.0 through 4.1.0 is exploitable once the attacker is authenticated. The principal limiting factors are therefore the authentication requirement and network reachability of the Orchestrator instance; the specific vulnerable feature or parameter is not named in the advisory description.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity SQL injection requiring only low-privilege authentication (PR:L), with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H) - consistent with an authenticated SQLi that can read, modify, and delete back-end database content. Signals are largely coherent and point to a genuine but contained risk: EPSS is low at 0.36% (28th percentile), indicating no statistical expectation of near-term mass exploitation, and the vulnerability is NOT in CISA KEV, with no public exploit identified at time of analysis. The main caveat is the authentication gate: because PR:L requires an attacker to already hold valid low-privilege credentials or a session, real-world risk is meaningfully lower than the 8.8 base score suggests for internet-exposed, unauthenticated scenarios. There is no conflict between the CVSS vector and the description - both agree on remote, authenticated exploitation. Net: patch on a normal-to-prompt cycle, prioritizing instances exposed to untrusted or broad user populations, but this is not a drop-everything event absent KEV listing or public PoC.

An attacker with valid low-privilege credentials to IBM Aspera Orchestrator sends specially crafted input through an application parameter that is unsafely concatenated into a SQL query. Because attack complexity is low and no user interaction is needed, the attacker can reliably inject statements to read, alter, or delete back-end database records. No public proof-of-concept exploit has been identified at time of analysis.