CVE-2023-37398 is a medium severity flaw (CVSS 5.9) in IBM Aspera Faspex 5, versions 5.0.0 through 5.0.10. The product did not enforce strong passwords by default, so user accounts were easier to compromise. IBM lists Faspex 5.0.11 as the fix and offers no workaround, so upgrade and then set a password policy.
What's affected
IBM's security bulletin lists Aspera Faspex 5 versions 5.0.0 to 5.0.10 as affected, and 5.0.11 as the version that remediates the issues. The bulletin was first published on 28 January 2025. IBM states that no workarounds or mitigations exist.
This CVE has the same description, score and bulletin as CVE-2023-35907. If your scanner reports both, treat them as one piece of work. The bulletin also lists CVE-2023-37412 and CVE-2023-37413, which are fixed by the same release.
How to check if you're exposed
Check the Faspex 5 version in the admin console or on the host. Versions 5.0.0 through 5.0.10 are affected.
Then check the behaviour rather than just the number. In a test environment, see what the sign up and password change forms accept. If a short or common password is allowed, your users can pick one. An upgrade changes the default, but organisations that carried settings forward should read them again.
Finally, compare the list of Faspex users with your directory. Stale accounts for people who left, or shared accounts, are the first place weak passwords hurt.
What to do now
- Find all Faspex 5 installs and their versions.
- Upgrade to 5.0.11 or later, using the IBM bulletin as the reference.
- Define and apply a password policy with a minimum length, and block known common passwords.
- Remove accounts that are no longer needed, and move remaining users to single sign on where possible.
- Monitor failed sign in attempts and alert on bursts from one address or against many accounts.
Why it matters
Weak password requirements (CWE-521) are a policy weakness, not a coding bug, and they stay dangerous because attackers automate the guessing. A product that accepts any password makes every account only as strong as its least careful user.
The score of 5.9 comes from a network attack vector with high complexity, and a high impact on confidentiality only. For a file transfer platform that can hold sensitive material, a medium score still deserves a scheduled fix. IBM does not describe attacks in the wild, and the CVE is not on the CISA Known Exploited Vulnerabilities list.
Quick check
Does upgrading force users to reset their passwords?
The bulletin does not say so. Plan your own reset for accounts with weak passwords after setting the new policy.
Which versions are affected?
Aspera Faspex 5.0.0 through 5.0.10, with the fix in 5.0.11.
Sources
Last reviewed: 19 October 2026.
