IBM Aspera Faspex CVE-2025-36171

Exploitation requires an authenticated, privileged Faspex 5 user account (CVSS PR:H) able to reach the product's API - the flaw is improperly validated API input leading to uncontrolled resource consumption (CWE-770). This is NOT a default-configuration, unauthenticated remote issue: the key limiting factor is that the attacker must already possess high-privilege credentials, confining realistic risk to malicious insiders or post-credential-compromise scenarios. No user interaction is needed (UI:N) and attack complexity is low (AC:L) once privileged API access exists. Affected deployments are IBM Aspera Faspex versions 5.0.0 through 5.0.13.1; the impact is availability loss only (C:N/I:N/A:H), with no data exposure or modification.

Signals align consistently toward a LOW real-world priority. The CVSS 3.1 base score is 4.9 (Medium), driven entirely by an availability impact (A:H) with no confidentiality or integrity effect (C:N/I:N). Critically, the vector requires high privileges (PR:H), meaning an already-privileged/authenticated user is needed to trigger the flaw - this is an insider or post-compromise abuse case, not a pre-auth remote threat, despite the network attack vector (AV:N) and low complexity (AC:L). EPSS reinforces low urgency at 0.32% (23rd percentile), and the vulnerability is NOT in CISA KEV with no public exploit identified. There is no SSVC decision record in the input. No signals conflict: a privilege-gated denial-of-service with low exploitation probability and no evidence of exploitation is a genuine low-to-medium priority - patch in normal cycles rather than emergency. One nuance to verify: AV:N combined with PR:H implies a remote but authenticated API consumer; confirm with IBM whether the required privilege is an ordinary authenticated Faspex account or a full administrator, as this materially changes the insider-threat surface.

An authenticated user holding elevated/administrative privileges on an IBM Aspera Faspex 5 instance sends crafted API requests with improperly bounded input, causing excessive resource (CPU/memory) consumption that degrades or halts the service for all users. No public exploit code was identified at time of analysis, and because high privileges are required (PR:H), realistic abuse comes from a malicious insider or an attacker who has already obtained privileged credentials.