IBM Secure Proxy versions 6.1.0.0 through 6.2.1.2 have an input validation flaw that permits a remote authenticated attacker to trigger a denial of service by supplying an improper listener IP address and port. The flaw lies in the logic that processes listener configuration. Exploitation leads the proxy to crash or become unresponsive, denying service to legitimate users and disrupting integration flows. The weakness is identified as CWE-20, improper input validation.

All IBM Sterling Secure Proxy deployments from 6.1.0.0 up to 6.1.0.46 and from 6.2.0.0 through 6.2.1.2 are affected. Vulnerable releases include 6.1.x before 6.1.0.5 and 6.2.x before 6.2.1.3; they are commonly run in enterprise integration environments where listener interfaces are configured, and misconfiguration can be exploited by authenticated users.

The CVSS score of 4.9 classifies the vulnerability as medium impact. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no widespread exploitation is currently documented. The attack requires remote authenticated access, typically through the Secure Proxy management interface, and the attacker must submit a listener configuration with an invalid IP or port. While the risk is limited to authenticated or privileged users, the ability to bring the service down justifies prompt remediation, even though the probability of immediate exploitation remains low.