CVE-2025-64648
Ibm Concert 1.0.0 – 2.2.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-64648 is a medium-severity Cleartext Transmission of Sensitive Information (CWE-319) vulnerability in Ibm Concert. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-209035
Vulnerability Data
IBM Concert 1.0.0 through 2.2.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Cleartext transmission of sensitive data directly enables Adversary-in-the-Middle (T1557) attacks, allowing interception of credentials or other sensitive information over the network.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires cryptographic protection of transmitted data to ensure confidentiality, eliminating the cleartext exposure described in CWE-319.
Mandates use of cryptography for data in transit, directly blocking the MITM risk from unencrypted IBM Concert traffic.
Requires encryption for remote access sessions, addressing the cleartext transmission vector when Concert is accessed over networks.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
Mandating cryptographic protection and stronger authentication on public networks stops the transmission of plaintext sensitive information.
Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.
Armoured conduits, electromagnetic shielding and locked enclosures make passive eavesdropping on unencrypted traffic traversing the cables more difficult, mitigating exposure of sensitive data in transit.