Db2 Recovery Expert CVE-2025-27902

Exploitation requires the victim to actively click an attacker-crafted link that resolves through the application's untrusted external web reference (UI:R) - it cannot be triggered server-side or automatically. No authentication is needed by the attacker to craft the link (PR:N), but the limiting factor is social engineering: the attacker must induce a legitimate user of the Db2 Recovery Expert 5.5 IF 2 web interface to follow the malicious redirect. Impact is confined to the victim's browser context (sensitive information exposure or unauthorized browser-side actions), not the server host.

This is a moderate-severity open redirect / untrusted link vulnerability (CWE-1022) in IBM Db2 Recovery Expert for LUW 5.5 IF 2, scored CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The CVSS vector shows network attack vector, low complexity, and no privileges required (PR:N, unauthenticated), but it mandates user interaction (UI:R) - the victim must click a crafted link - and only low confidentiality and integrity impact with no availability impact, which is consistent with a client-side redirect/phishing-assist bug rather than server compromise. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or widespread automated attack; absence of these signals plus the UI:R requirement strongly suggests this is a low real-world-priority issue despite the 'network/unauthenticated' framing. The scope change (S:C) reflects that the impact lands in the victim's browser/another security context rather than the vulnerable component itself. Overall: a genuine but low-urgency issue - patch in normal cycles, not an emergency.

An attacker crafts a malicious URL leveraging the application's untrusted web link and sends it to a victim via phishing email or chat. When the victim clicks and their browser follows the untrusted reference, the attacker can redirect them to an attacker-controlled site to harvest credentials or trigger unauthorized actions in the victim's browser session. No public exploit code was identified at time of analysis; success depends entirely on the victim clicking the crafted link.