Datapower Gateway 10 6Cd EUVD-2025-209176

The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects a network-accessible vulnerability with low attack complexity that requires no prior privileges but does require user interaction (such as clicking a malicious link). The 6.5 base score indicates medium severity with high integrity impact but no confidentiality or availability loss. While EPSS data is not provided, the real-world risk is moderate because successful exploitation depends on social engineering to trick an administrator or user into clicking a crafted link while authenticated to DataPower Gateway. The attack vector is network-based and the exploitation bar is low, but the requirement for user interaction significantly reduces the likelihood of automated or mass exploitation. Organizations running these versions in environments where administrators follow security hygiene (e.g., not clicking suspicious links) face lower immediate risk, but those with less mature security practices face elevated risk.

An attacker crafts a malicious web page or email containing an embedded request (e.g., an image tag with a modified DataPower Gateway configuration URL) and sends it to an authenticated DataPower Gateway administrator. When the administrator visits the malicious page while logged into DataPower Gateway in another browser tab, the forged request executes in the administrator's session without additional confirmation, allowing the attacker to modify gateway policies, disable security controls, or redirect traffic. No public exploit code is confirmed at this time, but the straightforward nature of CSRF attacks means exploitation requires minimal technical skill once a valid forged request is crafted.