CVE-2024-31873: 
IBM Security Verify Access (formerly ISAM) vulnerability analysis and mitigation

IBM Security Verify Access Appliance versions 10.0.0 through 10.0.7 contains a critical security vulnerability involving hard-coded credentials used for its own inbound authentication. The vulnerability was discovered and reported to IBM by Pierre Barre, and was publicly disclosed on April 10, 2024. This vulnerability has been assigned CVE-2024-31873 and IBM X-Force ID: 287317 (IBM Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-798 (Use of Hard-coded Credentials). The technical issue stems from the presence of hard-coded credentials that the system uses for its own inbound authentication process, which could potentially be discovered and exploited by malicious actors (NVD).

The vulnerability allows malicious actors to potentially obtain the hard-coded credentials used for inbound authentication. This could lead to unauthorized access to the system with high confidentiality impact, though integrity and availability are not affected according to the CVSS scoring (IBM Advisory).

The vulnerability has a network attack vector (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs no user interaction (UI:N) to exploit. This makes it relatively straightforward to exploit if an attacker can reach the affected system over the network (NVD).

IBM strongly recommends that customers update their systems promptly. The updated libraries are available on the public GitHub repository at https://github.com/IBM-Security/ibmsecurity. No specific workarounds or alternative mitigations have been provided by IBM (IBM Advisory).