IBM Aspera Faspex CVE-2025-36229

Exploitation requires a valid authenticated Faspex 5 user account (PR:L) with network access to the Faspex web application/API; it specifically targets the package-handling feature, where package identifiers can be enumerated to disclose sensitive information about data packages the user should not see. Limiting factors: the attacker must first possess working credentials (any low-privilege role appears sufficient), so unauthenticated internet-wide exploitation is not possible; impact is confined to confidentiality of package information (I:N/A:N), and risk scales with the number of distinct users/tenants whose packages reside on the same instance. Affected deployments are IBM Aspera Faspex 5 versions 5.0.0 through 5.0.14.1.

This is a low-to-moderate priority issue despite a network attack vector. The CVSS 3.1 base score of 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) reflects an authenticated information-disclosure flaw: network-reachable with low complexity, but requiring low-privilege authentication (PR:L), no user interaction, unchanged scope, and only limited confidentiality impact with zero integrity or availability effect. No EPSS score, KEV listing, or public exploit was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here - the signals consistently point to a minor confidentiality issue rather than a widespread, urgent threat. The practical risk is bounded: an attacker must already hold valid Faspex credentials, and the payoff is enumeration of package metadata/identifiers rather than system compromise. Treat this as a routine patch item, not an emergency; the main concern is in multi-tenant or large-user deployments where one authenticated user could enumerate packages belonging to others.

An authenticated Faspex 5 user (or an attacker who has phished/obtained any valid low-privilege account) iterates through sequential or guessable package identifiers via the web interface or API, retrieving metadata and sensitive details of data packages they were not intended to access. No public proof-of-concept was identified in the provided data; given AV:N/AC:L, the enumeration is straightforward to script once authenticated.