IBM watsonx.data intelligence EUVD-2025-209604

CRITICAL CONDITION: Local user access to the filesystem where watsonx.data intelligence stores credentials is required-this is NOT remotely exploitable. The credential files must be readable by unprivileged users (file permissions do not restrict access). The vulnerability is present in all default configurations of affected versions (5.2.0, 5.2.1, 5.3.0, 5.3.1) without requiring special setup or feature activation. Exploitation is LIMITED by: (1) local-only attack vector-attacker must first obtain local shell or code execution on the host, (2) no authentication bypass-the attacker leverages filesystem permissions, not protocol weaknesses, (3) credentials are only useful if corresponding backend services (databases, APIs) are accessible to the attacker after authentication.

The CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector with no access control complexity and no privilege requirements, yielding a 6.2 MEDIUM score. While the confidentiality impact is HIGH (credentials fully exposed), integrity and availability are unaffected. This is a local-only vulnerability-it does NOT support remote exploitation-which significantly reduces real-world risk compared to network-based attacks. The risk is contextual: in containerized or multi-tenant environments where local code execution is possible, this is a critical path to lateral movement and privilege escalation using stolen credentials. In restricted physical/logical access environments, risk is lower. No KEV confirmation, POC status, or EPSS score provided; patch availability from IBM reduces urgency but affected versions remain vulnerable if unpatched.

An attacker with local shell access (via SSH, container escape, or application RCE in a co-hosted service) reads plaintext credential files in watsonx.data intelligence directories. Armed with extracted database or API credentials, the attacker authenticates to backend systems or data services to exfiltrate data or pivot laterally within the organization's data infrastructure.