Security Vulnerability Report
中文
CVE-2025-13916 CVSS 5.9 MEDIUM

CVE-2025-13916

Published: 2026-04-01 21:16:57
Last Modified: 2026-04-06 16:49:10

Description

IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information

CVSS Details

CVSS Score
5.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Configurations (Affected Products)

cpe:2.3:a:ibm:aspera_shares:*:*:*:*:*:*:*:* - VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
IBM Aspera Shares 1.9.9
IBM Aspera Shares 1.10.0
IBM Aspera Shares 1.11.0

PoC / Exploit Code

⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# Proof of Concept for CVE-2025-13916 # This script demonstrates a theoretical decryption attempt # assuming a weak encryption algorithm is used. import base64 # Simulating a weak key scenario (e.g., hardcoded or short key) # In a real exploit, this key might be derived from the software's implementation WEAK_KEY = b"default_key" def simulate_weak_decryption(encrypted_payload): """ Simulates the decryption of data protected by a weak algorithm. """ try: # Pseudo-code representing the vulnerability # Example: XOR cipher or weak RC4 with a static key key_len = len(WEAK_KEY) decoded = base64.b64decode(encrypted_payload) decrypted = bytearray() for i in range(len(decoded)): decrypted.append(decoded[i] ^ WEAK_KEY[i % key_len]) return decrypted.decode('utf-8') except Exception as e: return f"Error: {str(e)}" # Example intercepted encrypted payload payload = "U2FsdGVkX1+vupJZgeV..." print(f"Attempting to decrypt intercepted payload...") # print(simulate_weak_decryption(payload))

References

Raw JSON Data

JSON
{"cve": {"id": "CVE-2025-13916", "sourceIdentifier": "[email protected]", "published": "2026-04-01T21:16:56.803", "lastModified": "2026-04-06T16:49:10.043", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 3.6}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-327"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:ibm:aspera_shares:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.9.9", "versionEndExcluding": "1.11.1", "matchCriteriaId": "E91033A7-CCAD-49AB-814E-73898AC951E9"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7267848", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}