IBM Concert Software versions 1.0.0 through 2.2.0 contain hard‑coded credentials that a local user can retrieve, allowing the user to impersonate privileged accounts or access protected data. This vulnerability is an example of CWE‑798, which involves the use of fixed passwords or keys in code. The risk is that an attacker with sole local access can elevate privileges or gain unauthorized authentication to the system.

The affected product is IBM Concert Software, specifically all releases from 1.0.0 up to and including 2.2.0. The recommended fix is to upgrade to IBM Concert Software 2.3.1, which removes the hard‑coded credential artifacts.

The CVSS score of 6.2 indicates moderate overall impact, while an EPSS score of less than 1% shows low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must have local console or filesystem access to exploit the hard‑coded credentials, so the risk is limited to environments where such local access is possible. Since the fix exists, immediate upgrade is the most effective mitigation.