CVE-2025-2667: IBM Sterling B2B Integrator Information Disclosure

CVE-2025-2667 Overview

CVE-2025-2667 is an information disclosure vulnerability affecting IBM Sterling B2B Integrator and IBM Sterling File Gateway. The flaw allows a privileged user to retrieve sensitive system information from the server. Disclosed data can support reconnaissance and strengthen follow-on attacks against the environment. The weakness is tracked under CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

The issue impacts IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4, and IBM Sterling File Gateway across the same ranges. IBM published remediation guidance in the vendor advisory.

Critical Impact
An authenticated attacker with high privileges can enumerate sensitive server details that enable deeper exploitation of integration and file transfer workloads.

Affected Products

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.4
IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4

Discovery Timeline

2025-09-04 - CVE-2025-2667 published to NVD
2026-10-18 - Last updated in NVD database

Technical Details for CVE-2025-2667

Vulnerability Analysis

IBM Sterling B2B Integrator and Sterling File Gateway expose sensitive system information to authenticated users with elevated privileges. The disclosed data can include configuration, environment, or runtime details that are not intended for operator visibility. An attacker who already holds administrative or privileged access can collect this information to map the deployment and prepare further intrusion steps.

Because the attack vector is network-based and no user interaction is required, the exploit path is straightforward once privileged credentials are obtained. The flaw does not alter data or disrupt availability, but it undermines the confidentiality boundary expected in multi-tenant and segregated administration models.

Root Cause

The root cause falls under [CWE-497], where application components return system-level details through interfaces accessible to privileged accounts. IBM has not published granular code-level details, but the behavior aligns with insufficient filtering of diagnostic, configuration, or environment data exposed through administrative functions.

Attack Vector

Exploitation requires an authenticated session with high privileges on the Sterling B2B Integrator or Sterling File Gateway console. The attacker interacts with the affected service over the network and reads sensitive output returned by the application. No separate exploit code is required, and no public proof-of-concept is listed in the enriched data. Refer to the IBM Support Page for vendor-specific technical context.

Detection Methods for CVE-2025-2667

Indicators of Compromise

Unexpected administrative logins to Sterling B2B Integrator or Sterling File Gateway outside normal operator schedules.
Repeated access to diagnostic, configuration, or system information endpoints by a single privileged account.
Export or download activity for configuration bundles or system reports that is inconsistent with change windows.

Detection Strategies

Audit application logs for privileged account activity against administrative URLs and diagnostic APIs.
Correlate Sterling console access with source IP reputation and geolocation anomalies.
Baseline normal administrator behavior and alert on deviations in access to system information resources.

Monitoring Recommendations

Forward Sterling B2B Integrator and File Gateway audit logs to a centralized SIEM or data lake for correlation.
Monitor underlying host telemetry for post-reconnaissance behavior such as credential harvesting or lateral movement.
Review privileged account inventories regularly and alert on new or dormant accounts being used against Sterling consoles.

How to Mitigate CVE-2025-2667

Immediate Actions Required

Apply the fixed version referenced in the IBM Support Page for your deployment track.
Review all accounts with administrative or privileged roles in Sterling B2B Integrator and Sterling File Gateway and remove unneeded entitlements.
Rotate credentials and session tokens for privileged accounts if the environment has been exposed to untrusted networks.

Patch Information

IBM has released fixed builds for the affected versions. Administrators should consult the IBM Support Page for the specific fix pack applicable to Sterling B2B Integrator 6.0.0.0–6.1.2.7_1, 6.2.0.0–6.2.0.4, and the corresponding Sterling File Gateway releases.

Workarounds

Restrict network reachability of Sterling administrative interfaces to trusted management subnets or jump hosts.
Enforce multi-factor authentication for all privileged accounts accessing Sterling consoles.
Limit the number of accounts granted administrative roles and apply least-privilege separation between operators and auditors.

bash

# Example: restrict access to Sterling admin interface via host firewall (Linux)
sudo iptables -A INPUT -p tcp --dport 5443 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5443 -j DROP