IBM EUVD-2025-208662

This vulnerability presents a low-to-moderate real-world risk profile when analyzed across multiple threat signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network accessibility and low attack complexity, but critically requires prior authentication (PR:L), which significantly reduces the attack surface compared to unauthenticated vulnerabilities. The confidentiality impact is limited (C:L) with no integrity or availability impact, classifying this as pure information disclosure. Without confirmed KEV status, active exploitation reports, or publicly available proofs-of-concept, the EPSS exploitation probability is likely moderate rather than critical. Using SSVC framework: exploitation is likely unproven (not in KEV), the attack is not automatable given authentication requirements, and technical impact is limited to information disclosure. Organizations should prioritize patches for unauthenticated remote code execution vulnerabilities first, but this should still be scheduled in regular patching cycles given the authenticated nature and limited blast radius.

An authenticated user (such as a disgruntled internal employee or compromised service account) logs into the IBM Sterling B2B Integrator interface and issues requests designed to trigger verbose error messages or system information disclosure in API responses. These responses reveal details such as internal host names, server versions, database connection strings, or network topology information. The attacker then uses this reconnaissance data to target other systems on the internal network, craft more sophisticated attacks, or identify additional vulnerable services running on discovered hosts. Since authentication is required, this attack is feasible only for users with legitimate access credentials, limiting the threat to insider threats or scenarios where credentials have been compromised through phishing or other means.