IBM EUVD-2025-209149

Real-world risk is substantial for organizations using affected IBM Storage Protect products. The CVSS 7.6 rating reflects high confidentiality impact, low integrity impact, and low availability impact, with the scope unchanged (S:U), indicating attackers remain within the vulnerable component's privileges. The critical factor is the PR:L (low privileges required) designation, meaning any authenticated user with basic credentials can exploit this vulnerability, significantly expanding the attack surface compared to admin-only flaws. While no EPSS score is provided and the vulnerability is not listed in CISA KEV (no confirmed active exploitation), SQL injection remains one of the OWASP Top 10 most critical web application risks and is frequently targeted once disclosed. The low attack complexity and network attack vector make this highly automatable once an attacker obtains valid credentials through phishing, credential stuffing, or insider access. For enterprise backup infrastructure, the impact extends beyond data confidentiality to include potential manipulation of backup catalogs, deletion of recovery points, or privilege escalation through database-level operations. Organizations with internet-exposed Storage Protect management interfaces face elevated risk, while those restricting access to internal management networks have reduced but not eliminated exposure due to insider threat scenarios.

An attacker with valid low-privilege credentials to the IBM Storage Protect management interface authenticates to the system and identifies a vulnerable input field in the web console or API endpoint that accepts user-supplied data for database queries. By injecting crafted SQL statements such as UNION-based queries or boolean-based blind injection payloads, the attacker extracts sensitive information from the back-end database including backup schedules, client configurations, administrator credentials stored in hashed form, or metadata about protected systems. The attacker then modifies backup policies to exclude critical systems from protection, deletes backup catalog entries to enable ransomware attacks without recovery options, or escalates privileges by inserting administrative accounts directly into the database. Authentication requirements not confirmed from available data.