IBM Concert versions 1.0.0 through 2.2.0 include hard‑coded credentials that can be retrieved by a local user. These credentials provide direct access to protected system functions, enabling the local attacker to authenticate without authorization. The vulnerability is classified under CWE‑798, indicating improper credential storage or disclosure.

The affected products are IBM Concert Software versions 1.0.0 and 2.2.0. The vendor recommends upgrading to version 2.3.1, which removes the hard‑coded credentials, to mitigate the risk.

The CVSS score of 6.2 labels this as a moderate severity issue. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local access; an attacker with local privileges can read the stored credentials and use them to gain further access to system resources. No remote exploitation vector is documented. The overall risk is moderate, but due to the sensitive nature of credential exposure, immediate action is advised.