CVE-2023-35907 is a medium severity flaw (CVSS 5.9) in IBM Aspera Faspex 5. Versions 5.0.0 through 5.0.10 did not require strong passwords by default, which makes account compromise easier. IBM lists Faspex 5.0.11 as the fix. Upgrade, then review your password policy settings.
What's affected
The CVE record and IBM's security bulletin list IBM Aspera Faspex 5.0.0 through 5.0.10. The bulletin, published on 28 January 2025, says the issues were remediated in Aspera Faspex 5.0.11 and gives a Linux fix link. IBM lists no workarounds or mitigations.
The same bulletin covers three other CVEs. CVE-2023-37398 carries an identical description to this one, and the other two are CVE-2023-37412 (a privileged user making system changes without proper access control) and CVE-2023-37413 (observable response differences that disclose usernames). One upgrade handles all four.
How to check if you're exposed
Look at the version shown in the Faspex 5 administration interface, or check the installed package on the host. Anything from 5.0.0 to 5.0.10 is in range.
Then review the password rules that your instance enforces. Create a test account with an obviously weak password in a non production environment and see whether the form accepts it. If it does, the instance has the weakness described here, whatever the version number says.
It is also worth listing which accounts exist, who owns them, and whether multi factor sign in or single sign on is in place. Strong rules for local passwords matter less when users sign in through your identity provider, so find out which path your users take.
What to do now
- Confirm the Faspex 5 version in each environment.
- Upgrade to 5.0.11 or later using the fix link in the IBM bulletin.
- After the upgrade, set a password policy that matches your organisation standard, with a sensible minimum length and a block list of common passwords.
- Ask users with short or reused passwords to change them, and turn on single sign on or multi factor sign in where Faspex supports it.
- Review sign in logs for repeated failures that suggest password guessing.
Why it matters
The weakness is CWE-521, weak password requirements. Nothing is broken in the code that checks passwords. The system simply lets people pick passwords that are easy to guess, and attackers rely on that. Guessing common passwords against many accounts is cheap and needs no special access.
The score reflects that. The record rates the attack complexity as high and confidentiality impact as high, with no effect on integrity or availability. Faspex is used to move large files between organisations, so a hijacked account can mean access to data that was meant for someone else. The CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Is there a workaround?
IBM lists none. The fix is to upgrade to 5.0.11.
Why are there two CVEs with the same description?
The records for CVE-2023-35907 and CVE-2023-37398 carry the same text, and IBM lists both in one bulletin. One upgrade covers both.
Sources
Last reviewed: 19 October 2026.
