What is the CVSS score of CVE-2025-33089?

CVE-2025-33089 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Concert are affected by CVE-2025-33089?

CVE-2025-33089 presents notable security risk, a hard-coded credentials vulnerability rated CVSS 6.5. Exploitation could allow attackers to execute code or inject malicious input.

How to fix or mitigate CVE-2025-33089?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Audit authentication configurations.

Concert CVE-2025-33089

MEDIUM

Use of Hard-coded Credentials (CWE-798)

2026-02-17 psirt@us.ibm.com

IBM Concert

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 17, 2026 - 20:22 nvd

MEDIUM 6.5

DescriptionCVE.org

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials.

AnalysisAI

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials. [CVSS 6.5 MEDIUM]

Technical ContextAI

Classified as CWE-798 (Use of Hard-coded Credentials). Affects Concert. IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials.

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Concert

View all

CVE-2024-52360 CRITICAL Act Now

9.8 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)

CVE-2024-43177 CRITICAL Act Now

9.8 Oct 22

IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated

CVE-2025-33015 HIGH This Week

8.8 Jan 20

Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).

CVE-2024-52359 HIGH This Week

8.8 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions

CVE-2025-33088 HIGH This Week

7.4 Feb 17

Concert versions up to 2.1.0 is affected by incorrect permission assignment for critical resource (CVSS 7.4).

CVE-2024-55909 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 could allow an authenticated user to cause a denial of service due to the expan

CVE-2024-55910 MEDIUM This Month

6.5 May 02

IBM Concert Software 1.0.0 through 1.0.5 is vulnerable to server-side request forgery (SSRF). Rated medium severity (CVS

CVE-2024-51451 MEDIUM This Month

6.5 Feb 04

Concert versions up to 2.1.0 contains a vulnerability that allows attackers to conduct various attacks against the vulne

CVE-2025-36018 MEDIUM This Month

6.5 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub component is vulnerable to cross-site request forgery which could allow an att

CVE-2024-37070 MEDIUM This Month

6.5 Nov 19

IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to obtain sensitive information

CVE-2024-43181 MEDIUM This Month

6.3 Feb 04

IBM Concert 1.0.0 through 2.1.0 does not invalidate session after logout which could allow an authenticated user to impe

CVE-2025-36019 MEDIUM This Month

6.1 Feb 17

IBM Concert 1.0.0 through 2.1.0 for Z hub framework is vulnerable to cross-site scripting. [CVSS 6.1 MEDIUM]

Same weakness CWE-798 – Use of Hard-coded Credentials

View all

CVE-2016-1560 CRITICAL POC

9.8

CVE-2017-14143 CRITICAL POC

9.8

CVE-2026-22769 CRITICAL

10.0

CVE-2016-5678 CRITICAL POC

9.8

CVE-2017-6558 CRITICAL POC

9.8

CVE-2015-7246 CRITICAL POC

9.8

CVE-2015-4667 CRITICAL POC

9.8

CVE-2016-10177 CRITICAL POC

9.8

CVE-2025-33089 vulnerability details – vuln.today

Back

Concert CVE-2025-33089

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Concert

Same weakness CWE-798 – Use of Hard-coded Credentials

Share

External POC / Exploit Code