IBM Controller 11.0.1, 11.1.0, 11.1.1, and 11.1.2 contain hard‑coded credentials—passwords or cryptographic keys—that the software uses for inbound authentication, outbound communication to external systems, and encryption of internal data. These credentials are embedded in the product rather than obtained from a secure source, allowing an attacker who can reach the controller or read its configuration to authenticate without valid user credentials. Once authenticated, the attacker can leverage administrative interfaces, manipulate internal processes, or gain unauthorized access to sensitive data.

IBM Controller versions 11.0.1 through 11.1.2 are affected, as identified by the product listing and the CPE entries for those releases.

The CVSS score of 8.8 indicates a high severity risk. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the hard‑coded credentials are used by the controller for authentication and communication, the likely attack vector is remote network access to the controller’s interfaces. If an attacker can send requests to the controller, they can exploit the embedded credentials to bypass authentication and potentially compromise the entire system.