Aspera Faspex
Vendor:
First CVE: May 24, 2022 · Active for 4 years
46
Total CVEs
More Total CVEs than 98% of tracked products
9.2
Avg CVEs / Year
Higher CVE frequency than 96% of tracked products
6.3
Avg CVSS
Higher Avg CVSS than 31% of tracked products
2.2%
KEV Rate
Higher KEV Rate than 98% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Aspera Faspex over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 24, 2022
4 years ago
Most Recent CVE
Mar 10, 2026
140 days ago
CVE Severity & Scoring
Aspera Faspex46 CVEs
63%
26%
All CVEs353,240 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local6 (13.0%)
Network40 (87.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low44 (95.7%)
High2 (4.3%)
Unknown0 (0.0%)
User Interaction
None37 (80.4%)
Unknown0 (0.0%)
Required9 (19.6%)
Privileges Required
Low26 (56.5%)
High3 (6.5%)
None17 (37.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (46 CVEs).
46 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-47986CRITICAL IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a special | Feb 17, 2023 | 9.8 | 98 | YES | YES |
CVE-2023-35907CRITICAL IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. | Jan 29, 2025 | 9.8 | 29 | NO | NO |
CVE-2023-27874HIGH IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to | Mar 21, 2023 | 8.8 | 27 | NO | NO |
CVE-2023-37398CRITICAL IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. | Jan 29, 2025 | 9.8 | 25 | NO | NO |
CVE-2022-22497HIGH IBM Aspera Faspex 4.4.1 and 5.0.0 could allow unauthorized access due to an incorrectly computed security token. IBM X-Force ID: 226951. | May 24, 2022 | 7.5 | 25 | NO | NO |
CVE-2025-33137HIGH IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-sid | May 22, 2025 | 8.8 | 24 | NO | NO |
CVE-2025-33136HIGH IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper p | May 22, 2025 | 8.8 | 24 | NO | NO |
CVE-2023-27871HIGH IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613 | Mar 21, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-27875HIGH IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. | Mar 16, 2023 | 7.5 | 24 | NO | NO |
CVE-2024-45098HIGH IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. | Sep 5, 2024 | 8.1 | 23 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (46 CVEs).
CISA KEV
1 CVE
2.2% of CVEs· 98th percentile
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
2.2% of CVEs· 97th percentile
ExploitDB
1 CVE
2.2% of CVEs· 85th percentile
Social Chatter
Signals from CVEs in this product scope (46 CVEs).
Media Mentions
Signals from CVEs in this product scope (46 CVEs).
Top CNAs Publishing CVEs For Aspera Faspex
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.0.4 | 1 | 7.5 | 0.6% | 0 | 0 |
| 5.0.1 | 1 | 6.5 | 0.4% | 0 | 0 |
| 5.0.0 | 2 | 7.0 | 0.8% | 0 | 0 |
| 4.4.2 | 4 | 8.2 | 25.8% | 1 | 1 |
| 4.4.1 | 2 | 6.5 | 0.8% | 0 | 0 |