IBM Aspera Faspex CVE-2025-36225

Exploitation requires an authenticated low-privilege user account on the IBM Aspera Faspex server (PR:L), on a version between 5.0.0 and 5.0.13.1. The attacker must be able to interact with the affected functionality and compare responses across requests to detect the observable discrepancy (CWE-203). Limiting factors: valid credentials are mandatory (no anonymous/unauthenticated path), only confidential information is at risk (no data modification or service disruption), and the practical value depends on the sensitivity of the inferable data, which IBM's advisory does not detail.

This is a genuinely low-to-moderate priority issue, not a high-urgency one. The CVSS 3.1 base score of 4.3 (Medium) is internally consistent with the vector: network reachable (AV:N) and low attack complexity (AC:L), but it requires an already-authenticated low-privilege account (PR:L) and yields only limited confidentiality impact (C:L) with no integrity or availability impact (I:N/A:N). The CWE-203 (observable discrepancy / information exposure through behavioral differences) aligns with the description of sensitive user information being inferable from differences in returned data. Corroborating signals point to low real-world urgency: EPSS is 0.23% (13th percentile), the CVE is NOT on CISA KEV, and no public proof-of-concept was provided. There is no conflict among the signals - all point the same direction (low practical exploitation likelihood, limited impact, authentication barrier). The main caveat is that this is an information-disclosure primitive, so its true value to an attacker depends on how sensitive the disclosed 'user information' is (e.g., valid usernames, account state), which the terse IBM-sourced description does not specify; verify the exact data exposed against IBM support node 7247502.

An attacker who already holds valid low-privilege credentials on an IBM Aspera Faspex 5 instance issues crafted requests and observes measurable differences in the server's responses (timing, content, or error behavior) to infer sensitive information about other users or accounts that should not be visible to them. No public exploit code was identified, and the attack requires an authenticated session, so exploitation is limited to insiders or attackers who have already obtained credentials.