Guardium Data Protection EUVD-2026-83416

Requires an authenticated low-privileged account on the IBM Guardium Data Protection 12.2 appliance plus the ability to access the hardware_assess/obstore binaries to recover the embedded hardcoded master secret; the recovered secret then permits unauthorized access to the internal database. Limiting factors: exploitation is gated by existing authenticated access to the appliance (PR:L), is confined to this specific niche product and version, and the described mechanism (reading secrets out of on-box binaries) suggests local/CLI access to the appliance rather than purely remote interaction.

The vendor CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) presents this as a high-severity, network-exploitable, low-privilege flaw with full triad impact - but that rating appears inflated for a hardcoded-credentials weakness (CWE-798). Recovering hardcoded master secrets embedded in the hardware_assess/obstore binaries realistically requires reading those on-appliance binaries, which points to local/CLI access (AV:L) rather than a clean remote network vector. The impact is confidentiality-primary: the exposed secret grants access to the internal database and 'sensitive system information,' so C:H is defensible, but I:H and A:H are overstated absent evidence the secret enables destructive database writes or availability loss. No EPSS score, no CISA KEV listing, and no public POC are present, so there is no signal of active or imminent exploitation. Net assessment: no public exploit identified at time of analysis; this is a genuine credential-exposure issue but a moderate real-world priority (my independent estimate ~6.1) rather than a critical one, materially discounted by the niche appliance footprint and the practical need for prior authenticated access to the appliance internals. Note the conflict: CVSS asserts AV:N while the described mechanism (extracting secrets from local binaries) implies AV:L - verify the exact recovery path with IBM.

A low-privileged but authenticated user of a Guardium Data Protection 12.2 appliance accesses the hardware_assess or obstore binaries and extracts the hardcoded product master secret embedded within them. They then reuse that master secret to authenticate directly to the internal database, reading protected configuration and monitored data outside their authorization. No public exploit code is known, and exploitation presupposes existing authenticated access to the appliance.