Aspera Console CVE-2025-13460

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects accurate baseline severity: the attack requires no network privileges or user interaction and has low complexity, yielding confidentiality impact only. However, real-world risk is contextual and moderate. Username enumeration is a reconnaissance-only attack with no direct system compromise; its value depends on downstream exploitation (password attacks, social engineering, or zero-days against Aspera). The attack vector being network-accessible and unauthenticated elevates risk in internet-facing deployments. Lack of reported EPSS data or active exploitation in the wild (no KEV status mentioned) suggests this is not being weaponized at scale, reducing urgency below critical vulnerabilities. Organizations with Aspera Console exposed on untrusted networks should prioritize patching within standard maintenance windows; internal-only deployments can defer updates longer. The real priority is preventing chaining: pair this patch with strong password policies and monitoring for enumeration attempts.

An attacker performs reconnaissance against an internet-exposed IBM Aspera Console instance by sending repeated authentication requests with a list of common usernames (admin, aspera, service, etc.). By analyzing differences in HTTP responses—such as status codes, error message text, or response delays—the attacker identifies which usernames are valid within the system. Armed with a list of confirmed usernames, the attacker then executes a credential stuffing attack using breached password databases or launches targeted phishing campaigns against identified users. Because attack complexity is low and requires no authentication, enumeration can be automated at scale with minimal detection risk using common HTTP fuzzing tools or custom scripts.