Spectrum Protect Server EUVD-2025-18753

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-based attack requiring HIGH complexity (AC:H), which moderates real-world exploitability despite the high impact rating. The High attack complexity suggests the vulnerability may require specific conditions, timing, or knowledge of internal architecture to exploit. Without confirmed EPSS score or KEV/CISA status data provided, assessment relies on the CVSS profile: the vulnerability affects confidentiality, integrity, and availability equally (High across all three), making it a complete system compromise risk. The lack of privilege requirements (PR:N) and user interaction (UI:N) means any unauthenticated attacker on the network can attempt exploitation. Organizations running Spectrum Protect in network-accessible configurations face elevated risk, though the AC:H factor suggests this is not trivial 'worm-like' exploitation. Prioritize based on internet exposure and backup system criticality.

An attacker on the same network as (or with network visibility to) an IBM Spectrum Protect Server instance begins probing the administrative interface on port 1500. Through reconnaissance, the attacker identifies the target runs version 8.1.15. The attacker crafts a malformed session initialization request or reuses a previously captured session token, exploiting the improper session validation logic. Because the server fails to cryptographically validate the session or re-authenticate, the attacker gains authenticated status without providing valid credentials. The attacker then queries the backup catalog, modifies backup retention policies, or exfiltrates backup metadata—actions normally restricted to authenticated administrators. Given the AC:H factor, the attacker likely requires specific knowledge of session structure or timing; however, once successful, complete access to the backup infrastructure is achieved, potentially enabling data theft, ransomware staging, or denial of service against backup recovery capabilities. No public POC is referenced in available data, but the straightforward nature of authentication bypass (CWE-306) suggests weaponization is likely.