What is the CVSS score of EUVD-2025-208660?

EUVD-2025-208660 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Aspera Console are affected by EUVD-2025-208660?

CVE-2025-13460 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate EUVD-2025-208660?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Aspera Console EUVD-2025-208660

| CVE-2025-13460 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-03-13 ibm

IBM Information Disclosure Aspera Console

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 17, 2026 - 15:50 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2025-208660

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 19:54 nvd

MEDIUM 5.3

DescriptionCVE.org

IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.

AnalysisAI

IBM Aspera Console versions 3.3.0 through 3.4.8 contain a username enumeration vulnerability caused by observable response discrepancies in authentication mechanisms. An unauthenticated remote attacker can exploit this to enumerate valid usernames through response analysis, enabling reconnaissance for subsequent targeted attacks. With a CVSS score of 5.3 and low attack complexity, this is a low-to-moderate severity information disclosure issue suitable for standard patch management cycles rather than emergency response.

Technical ContextAI

The vulnerability exists in IBM Aspera Console (cpe:2.3:a:ibm:aspera_console) and falls under CWE-204 (Observable Response Discrepancy), a timing or behavioral analysis class where the system leaks information through differences in error messages, response times, or HTTP status codes during authentication attempts. In this case, the Aspera Console authentication handler likely returns distinguishable responses when presented with valid versus invalid usernames—for example, different HTTP status codes (401 vs 404), varying response lengths, or distinct error message strings. This allows attackers to systematically probe the application to determine which usernames exist in the system without needing valid credentials. The vulnerability is specific to the Aspera Console product line, a commercial file transfer and workflow acceleration platform commonly deployed in enterprise environments for high-performance data distribution.

RemediationAI

Immediately upgrade IBM Aspera Console to version 3.4.9 or later, or to the latest 3.5.x release if available, following IBM's official patch guidance and pre-upgrade compatibility checks for your deployment. If immediate patching is not feasible, implement network-level access controls to restrict Aspera Console authentication endpoints to trusted IP ranges, disable or firewall any public-facing authentication interfaces, and deploy HTTP request logging to detect enumeration attempts (e.g., high volumes of failed login requests to the same endpoint with varying usernames). Enable multi-factor authentication where supported to reduce the impact of compromised credentials obtained through enumeration. Monitor Aspera console logs for suspicious authentication patterns and coordinate with identity and access management teams to enforce strong password policies that reduce the value of enumerated usernames to attackers.