CVE-2023-37400 is a high severity (CVSS 7.8 in NVD, 8.4 from IBM) local privilege escalation in IBM Aspera Faspex 5, caused by insecure credential storage. IBM's bulletin lists versions 5.0.0 through 5.0.7 as affected and 5.0.8 as the fix. Upgrade to 5.0.8 or later.
What's affected
IBM's security bulletin says Aspera Faspex 5 versions 5.0.0 through 5.0.7 are affected. The fixing version it lists is 5.0.8, for Linux. IBM states there are no workarounds or mitigations.
The weakness is CWE-522 (insufficiently protected credentials). The description says a local user could escalate privileges because credentials are stored insecurely.
The sources disagree on severity. The NVD record scores it 7.8 (high) with the vector CVSS 3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, which assumes the attacker already holds a low privilege local account. IBM's bulletin gives a base score of 8.4 using CVSS 3.0 with no privileges required (PR:N). Both rate it high, and the fix is the same.
How to check if you're exposed
- Sign in to your Faspex 5 instance as an administrator and read the product version in the admin interface or the about information.
- If the version is between 5.0.0 and 5.0.7 inclusive, you are in the affected range named by IBM.
- On the server, check who holds local accounts. The flaw needs local access, so a short list of shell users lowers the risk.
- Read the IBM bulletin for the fix download and any follow-up notes for your platform.
What to do now
- Upgrade Faspex 5 to 5.0.8 or later using the fix link in IBM's bulletin. IBM says to apply it as soon as possible.
- Review who has local or shell access to the Faspex host, and remove accounts that are not needed.
- After patching, consider rotating any credentials the product stores, since a local user with the old version could have read them. The bulletin does not say this, so treat it as a precaution based on the weakness class.
- Subscribe to IBM security bulletin notifications for the product.
Why it matters
Insecure credential storage means secrets sit where a user who should not see them can read them. The bulletin does not explain the exact location, and I will not guess. What the class tells you is that an attacker with a foothold on the machine, even a low privilege one, may be able to pick up a credential that carries more rights, and use it to move up.
That makes the fix a priority on shared servers, where several people or services hold local accounts. The record does not mark the CVE as known exploited, and the IBM bulletin does not report exploitation. Keep an inventory of the file transfer and other server software you run, so the version question is a lookup, not a hunt. You can also run the free in-browser dependency scan at gold.safeguard.sh/scan against a manifest or lockfile, and browse the Gold directory for related entries.
Quick check
Is this remotely exploitable?
No. Both NVD and IBM give a local attack vector, so an attacker needs access to the host first. That still matters on servers with several accounts.
Sources
Last reviewed: 19 October 2026.
