IBM DOORS Next CVE-2025-2140

Exploitation requires an authenticated account (PR:L) and adjacent-network position (AV:A) to the IBM Engineering Requirements Management DOORS Next server (7.0.2, 7.0.3, or 7.1); the attacker abuses the application's improper verification of source data (CWE-346) to spoof the email identity of the sender. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: the attacker must already hold valid credentials and be on the same/adjacent network segment rather than the open internet, and impact is confined to integrity/identity spoofing (C:N, A:N) with no data disclosure or service disruption.

This is a moderate-severity integrity issue that is unlikely to be a top patching priority. The CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) describes an adjacent-network, low-complexity attack requiring an authenticated low-privilege user, with impact limited to integrity (email sender identity spoofing) and no confidentiality or availability impact. All exploitation signals point low: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided data, so there is no public exploit identified at time of analysis. The adjacent attack vector (AV:A) and authentication requirement (PR:L) meaningfully constrain the attacker population to insiders or those already on the same network segment with valid credentials. The signals are internally consistent - a low EPSS, no KEV, and an authenticated/adjacent vector all agree this is a real but low-urgency weakness rather than a high-CVSS-but-overstated issue. No conflicting data was observed; the only metadata concern is the 'Information Disclosure' tag, which contradicts the vector (C:N, I:H points to spoofing/integrity, not disclosure).

An authenticated user on the same network as the DOORS Next server abuses the application's improper verification of source data to send notification or workflow emails that appear to originate from a trusted sender (e.g., an administrator or project lead). A recipient trusts the spoofed message and acts on forged instructions, enabling social engineering or phishing. No public exploit code is known, and the attack requires valid credentials plus adjacent-network access.