IBM Aspera Faspex Code Execution Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Feb 17, 2023 · Catalog

   Detected

   IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

2. Feb 21, 2023 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Mar 14, 2023 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.

Affected

• cpe ibm/aspera faspexversion unspecified
• cpe ibm/aspera faspex4.4.2
• vendor IBM Aspera Faspexversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2022-47986

  IBM Aspera Faspex could allow a remote attacker to execute code on the system, caused by a YAML deserialization flaw.

  cisa.gov
• CVE.orgVulnerability recordCVE-2022-47986

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2022-47986

  30-day exploitation probability 100.0%

  first.org
• Exploit DatabasePublic exploit reference51316

  Public archive entry. The exploit body is not stored here.

  exploit-db.com
• NIST NVDVulnerability recordCVE-2022-47986

  IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code

  nvd.nist.gov
• Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/171772/IBM-Aspera-Faspex-4.4.1-YAML-Deserialization.html

  Packet Storm link already published on the finding.

  packetstormsecurity.com

References

• Third Party Advisory · packetstormsecurity.com
• VDB Entry · exchange.xforce.ibmcloud.com
• CISA note · exchange.xforce.ibmcloud.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov
• Patch · ibm.com