IBM EUVD-2025-208854

The CVSS 3.1 score of 6.2 reflects a Medium severity with high confidentiality impact (C:H), no integrity or availability impact, local attack vector (AV:L), and no privilege escalation requirement (PR:N). While the CVSS score is moderate, the real-world risk is amplified by several factors: (1) QRadar is a high-value target as a centralized security platform holding organization-wide threat intelligence and authentication data; (2) the attack vector is local-only, limiting immediate risk to insider threats or post-compromise scenarios where an attacker has gained initial system access; (3) no active KEV exploitation data is provided, suggesting this is not yet weaponized at scale; (4) patch availability and vendor support reduce timeline-to-remediation risk. The SSVC framework would likely classify this as having limited exploitation likelihood due to local-only access, but the technical impact is significant if an attacker obtains configuration credentials. Organizations should treat this as a standard priority for patching but not an emergency, unless they operate in high-risk environments with significant insider threat concerns or high likelihood of system compromise via other vectors.

An attacker who gains local shell access to a QRadar server through a compromised service account, unpatched remote vulnerability, or insider access can directly read the insufficiently protected configuration files containing stored credentials. Once extracted, these credentials grant access to downstream systems that QRadar integrates with, such as SIEM data sources, ticketing systems, or authentication providers, enabling the attacker to pivot laterally across the security infrastructure while avoiding detection by the very SIEM system meant to catch such activity. The local-only attack vector limits the threat to scenarios where the attacker has already established a foothold on the QRadar system itself, making this a critical post-exploitation privilege escalation risk rather than an initial access vector.