The vulnerability allows an attacker to enumerate usernames due to an observable response discrepancy. This information disclosure is classified as CWE‑204 and could expose user identities, enabling potential social engineering or further attacks. The impact is limited to disclosure of sensitive information and does not provide direct code execution or privilege escalation.

IBM Aspera Console versions 3.3.0 through 3.4.8 are affected on both Windows and Linux platforms. Versions higher than 3.4.8, such as 3.4.9, include the remediation and are not vulnerable.

The CVSS score of 5.3 indicates moderate risk, while an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the vulnerability via a remote network request to the console, without needing local privileges. The nature of the response discrepancy suggests that enumeration may be possible even without authentication, though the exact scope depends on the console configuration.