IBM watsonx.data intelligence EUVD-2025-210384

Successful exploitation requires the attacker to achieve a man-in-the-middle network position on the communication path between IBM watsonx.data intelligence components or between a client and the platform - this is the AC:H constraint in the CVSS vector, representing a genuine real-world barrier. Network proximity or infrastructure compromise (ARP spoofing, rogue network device, BGP hijack, or shared cloud network segment) is required to intercept traffic. No application-layer credentials are required (PR:N per CVSS), and no user interaction is needed (UI:N). Exploitation is strictly limited to confidentiality - there is no integrity or availability impact. The vulnerability appears to affect standard platform operation across all listed versions without requiring any non-default application configuration, as the cleartext transmission is a base platform behavior rather than a conditional feature.

The CVSS 5.9 (Medium) score with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N captures two competing signals: the High confidentiality impact (C:H) reflects the genuine sensitivity of data at risk if interception occurs, while the High attack complexity (AC:H) reflects the real-world prerequisite that the attacker must first achieve a man-in-the-middle network position - a non-trivial precondition. No EPSS data was provided, preventing quantitative exploitation probability assessment. This vulnerability is not in the CISA KEV catalog and no public proof-of-concept has been identified, indicating no observed opportunistic or widespread exploitation at time of analysis. The practical risk is highest in environments with flat network architectures, shared cloud tenancy, or exposed inter-service communication paths lacking network-level TLS enforcement. In hardened environments with mutual TLS between components and strong network segmentation, real-world exploitability is substantially reduced. This is a genuine Medium-priority issue - not a theoretical paperweight, but also not an emergency requiring emergency response absent network exposure.

An attacker who has achieved a man-in-the-middle position on the network path - for example, via ARP spoofing on a shared network segment, by compromising a network switch or router, or by operating on the same cloud virtual network - passively captures unencrypted traffic between IBM watsonx.data intelligence components or between an end user and the platform. The captured plaintext may contain sensitive information such as authentication tokens, query content, or data intelligence payloads. No public exploit code has been identified at time of analysis; the attack requires network positioning but no application-layer exploitation skill.