Datapower Gateway 10 6Cd EUVD-2025-209174

Real-world risk is low despite network accessibility. The CVSS vector (PR:H, AC:L, AV:N, C:L, I:N, A:N) mandates high-privilege authentication, significantly narrowing the threat actor pool to malicious insiders or compromised administrative accounts. EPSS exploitation probability data is not provided, but the absence of public exploit code and lack of CISA KEV confirmation suggest limited active abuse. The information disclosure impact is constrained (C:L, partial confidentiality loss), and there is no integrity or availability impact. The patch is already available from the vendor, further reducing residual risk. This is a classic low-severity internal-threat scenario: high-privilege attackers with legitimate admin access can extract cross-domain information, but the barrier to exploitation is authentication itself. Organizations with strong access controls and administrative credential hygiene face minimal practical risk.

A disgruntled system administrator with legitimate access to the DataPower Gateway administrative console could authenticate to the interface and enumerate configuration or runtime details from other administrative domains without authorization, potentially exposing secrets, API policies, or system metadata that should remain compartmentalized. The low attack complexity and network accessibility mean the exploit requires only valid administrative credentials and knowledge of the DataPower Gateway UI-no special tools or code execution are needed. No public proof-of-concept has been identified.