CVE-2025-14480
Weak Cryptography in IBM Aspera faspio Gateway 1.3.6 Enables Data Decryption
Publication date: 2026-03-03
Last updated on: 2026-03-05
Assigner: IBM Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ibm | aspera_faspio_gateway | 1.3.6 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-327 | The product uses a broken or risky cryptographic algorithm or protocol. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade IBM Aspera faspio Gateway from version 1.3.6 to version 1.3.7.
IBM has released version 1.3.7 as a fix for this vulnerability across multiple platforms including Windows, Linux (x86, PPC, zSeries), and Mac OSX.
No other workarounds or mitigations are provided other than applying the update.
Can you explain this vulnerability to me?
CVE-2025-14480 affects IBM Aspera faspio Gateway version 1.3.6 and is caused by the use of weaker than expected cryptographic algorithms, classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm).
This weakness could allow an attacker with local access and high attack complexity to decrypt highly sensitive information without requiring privileges or user interaction.
How can this vulnerability impact me? :
The vulnerability can lead to the decryption of highly sensitive information by an attacker who has local access to the system.
This compromises the confidentiality of sensitive data, although it does not affect the integrity or availability of the system.
Because the attack requires local access and has high attack complexity, the risk is somewhat limited but still significant for environments where sensitive data is handled.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know