IBM Cloud Pak for Data CVE-2025-14754

Requires a valid authenticated account on IBM Cloud Pak for Data 5.1.2 (PR:L) with the ability to reach the vulnerable input field over the network; no user interaction and no non-default configuration are stated as prerequisites. The primary limiting factor is the authentication requirement - an attacker must first obtain low-privilege credentials or account access - but no additional privilege, special deployment mode, or victim interaction is needed. Exploitation is version-specific to 5.1.2; applying the vendor patch removes the exposure.

This is a genuine high-priority issue. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication, and CWE-78 OS command injection with full C:H/I:H/A:H impact is a classic path to system compromise - the description explicitly states execution of arbitrary commands 'with elevated privileges,' implying privilege escalation beyond the attacker's initial role. Signal completeness is limited: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automatability, and no SSVC decision data is available. Thus the 8.8 score reflects high potential impact and ease-of-exploit for an authenticated actor rather than confirmed real-world exploitation - priority should be driven by the low privilege bar and command-execution impact, not by exploitation telemetry, which is absent. One note: the vendor rates S:U despite 'elevated privileges,' which arguably crosses a security scope (S:C); this does not change the practical severity but is worth verifying against the IBM advisory.

An authenticated low-privilege user of IBM Cloud Pak for Data 5.1.2 submits crafted input into a field that is improperly validated and passed to a system shell, causing the platform to execute attacker-chosen OS commands with elevated privileges. Given AV:N/AC:L, this is achievable remotely over the network with a normal user account and no user interaction. No public exploit code was identified at time of analysis.