IBM Aspera Orchestrator CVE-2025-13481

Requires an authenticated account on IBM Aspera Orchestrator (versions 4.0.0 through 4.1.0); the CVSS PR:L metric confirms some valid login is needed, so this is not exploitable by fully unauthenticated attackers. The flaw stems from improper validation of user-supplied input (CWE-78 OS command injection) in the application, which then executes commands at elevated privilege. Limiting factors: attacker must first possess or obtain valid credentials, and the instance must be reachable over the network (AV:N); no user interaction by a victim is required (UI:N) and attack complexity is low (AC:L). The provided data does not name the exact field, API, or configuration mode that carries the injection, so the specific vulnerable feature should be confirmed with the IBM advisory before scoping compensating controls.

Signals are moderately aligned but point to a credentialed-insider/post-compromise threat rather than mass internet exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8 HIGH) describes network-reachable, low-complexity exploitation requiring low-level authentication (PR:L) with no user interaction and full CIA impact - consistent with a command-injection flaw (CWE-78) that lets an already-authenticated user escalate to arbitrary OS command execution with elevated privileges. However, EPSS is low at 0.48% (39th percentile), indicating no statistical evidence of imminent widespread exploitation, which is coherent with the PR:L authentication barrier. This is NOT in CISA KEV and no public exploit code was identified in the provided data, so there is no confirmed active exploitation. No SSVC decision data was supplied, so automatable/exploitation-maturity cannot be assessed from the input. Net: a genuine high-severity issue worth prioritized patching in environments running Aspera Orchestrator, but the authentication requirement and absence of KEV/POC signals place it below drop-everything internet-facing criticals - treat as high priority for exposed or multi-tenant deployments, standard patch cadence otherwise.

An attacker who already holds valid low-privilege credentials to an IBM Aspera Orchestrator instance (4.0.0-4.1.0) submits crafted input into a field that is improperly validated, injecting OS commands that the application executes with elevated privileges. This yields arbitrary command execution on the underlying host, enabling full compromise of the Orchestrator server. No public exploit code was identified at time of analysis, and the attack requires authentication, so the realistic actor is a malicious insider or an attacker who has phished or otherwise obtained user credentials.