IBM watsonx.data EUVD-2025-210375

Exploitation requires the attacker to achieve a man-in-the-middle network position between IBM watsonx.data intelligence and its communication partners - for example, through ARP poisoning, DNS hijacking, a compromised router or switch, or physical access to the same network segment. CVSS AC:H explicitly encodes this positional prerequisite, limiting exploitation to attackers with meaningful network access or insider capability. Exploitation is not possible for purely remote attackers without network positioning. The vulnerability affects only versions 5.2.0, 5.2.1, 5.2.2, and 5.3.0; organizations on earlier or later versions (once patched) are not affected. No user interaction by a victim is required once the attacker is on-path. Authentication by the attacker is not required - the interception is passive.

The CVSS base score of 5.9 (Medium) is driven by AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. The High confidentiality impact reflects that intercepted data may include sensitive enterprise information, but AC:H is a meaningful risk-reducer: exploitation requires the attacker to achieve an on-path network position, which is not trivially accessible in most enterprise deployments. No EPSS score was provided in the input, preventing quantitative exploitation-probability assessment. No CISA KEV listing and no public exploit code have been identified, placing this in a lower-urgency category for most organizations. The primary real-world risk is insider threat or compromised network infrastructure scenarios. This is a legitimate finding but is not a critical emergency in well-segmented environments - organizations with zero-trust network architectures or encrypted internal traffic will have substantially reduced exposure.

An attacker who has compromised a network device or gained access to the same network segment as an IBM watsonx.data intelligence deployment uses ARP spoofing or a rogue routing device to position themselves on the communication path between the watsonx.data service and a client or backend system. The attacker passively captures unencrypted traffic and extracts sensitive data such as API credentials, query results, or internal data records. No exploit code is required; standard network capture tools suffice once the on-path position is established.