Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-33084 is a medium-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Ibm Concert. Its CVSS base score is 5.9 (Medium).
Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-27841
Vulnerability Data
IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the…
more
middle techniques.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires protection of transmitted information confidentiality and integrity, which HSTS enforces by mandating HTTPS and blocking MITM downgrade attacks on this CVE.
Mandates use of approved cryptographic mechanisms for data in transit, addressing the missing HSTS configuration that leaves the IBM Concert instance vulnerable to CWE-327 MITM exposure.
Requires applying secure baseline configuration settings, which would include enabling HSTS headers on the web server to close the exact exposure described in the CVE.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
PR.DS-01 promotes encryption for data-at-rest but never requires strong algorithms, leaving CWE-327 fully possible; the weakness is also far broader than data-at-rest so one narrow control removes none of its total risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating approved algorithms, cipher strength and usage standards directly stops the selection of broken or weak cryptographic primitives that attackers can exploit.
The explicit call-out of cryptography-related legal constraints (import/export, key escrow, digital-signature validity) reduces the likelihood that an organization will adopt broken or non-compliant cryptographic algorithms that violate those rules.
Access to current specialist guidance and early vulnerability alerts enables timely replacement of broken or risky cryptographic algorithms with stronger alternatives.