IBM Concert Software versions 1.0.0 through 1.1.0 contain hard-coded credentials, such as a password or cryptographic key. These credentials are used for inbound authentication, outbound communication to external components, or encryption of internal data. This vulnerability poses a risk to the confidentiality of the system.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.2 | CVE-2025-33100 |
Exploitation
To exploit this vulnerability, an attacker with local access could leverage the hard-coded credentials to gain unauthorized access to the system. This could allow them to perform actions that compromise the confidentiality of sensitive data.
Affected Products
- IBM Concert Software 1.0.0: Initial release with hard-coded credentials.
- IBM Concert Software 1.1.0: Update that still contains the same vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to a version of IBM Concert Software that does not contain hard-coded credentials. Additionally, implementing proper credential management practices can help prevent similar vulnerabilities in the future.