CVE-2024-43169 is a vulnerability identified in IBM Engineering Requirements Management DOORS Next versions 7.0.2, 7.0.3, and 7.1. The core issue is a CWE-494 weakness, where the software allows users to download code or files without performing any integrity verification, such as cryptographic signature or hash validation. This flaw enables an attacker to craft malicious files that, when downloaded and executed or processed by the user, can compromise the system. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting its high severity due to network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The impact metrics indicate high confidentiality, integrity, and availability impacts (C:H/I:H/A:H), meaning a successful exploit could lead to full system compromise, data theft, or disruption of service. The vulnerability does not require prior authentication, making it accessible to remote attackers. Although no exploits are currently known in the wild, the potential for targeted attacks exists, especially in environments where IBM DOORS Next is used for managing critical engineering requirements. The lack of integrity checks on downloaded code is a fundamental security oversight that can be leveraged for supply chain attacks or malware delivery. IBM has not yet published patches, so organizations must monitor for updates and apply them promptly once available.

The potential impact of CVE-2024-43169 is significant for organizations using IBM Engineering Requirements Management DOORS Next. Because the vulnerability allows downloading malicious files without integrity verification, attackers can deliver malware, ransomware, or backdoors to compromise systems. This can lead to unauthorized access to sensitive engineering data, intellectual property theft, disruption of project workflows, and potential sabotage of critical engineering processes. The high confidentiality impact means sensitive design and requirements data could be exposed, while the high integrity impact implies attackers could alter or inject malicious code into project files. The high availability impact suggests attackers might disrupt or disable the software, affecting business continuity. Industries such as aerospace, automotive, defense, and manufacturing, which rely heavily on IBM DOORS Next for requirements management, face increased risk of espionage and operational disruption. The vulnerability’s ease of exploitation (no privileges required, network accessible) increases the likelihood of attacks, especially spear-phishing or social engineering campaigns to induce user interaction. The absence of known exploits currently provides a window for proactive mitigation, but the threat landscape could evolve rapidly.

1. Monitor IBM security advisories closely and apply official patches or updates for DOORS Next versions 7.0.2, 7.0.3, and 7.1 immediately upon release. 2. Until patches are available, restrict network access to IBM DOORS Next servers to trusted IPs and enforce strict firewall rules to limit exposure. 3. Implement application whitelisting and endpoint protection solutions to detect and block execution of unauthorized or suspicious files downloaded via DOORS Next. 4. Educate users on the risks of interacting with unexpected or suspicious downloads within the DOORS Next environment to reduce the chance of social engineering exploitation. 5. Use network security tools such as intrusion detection/prevention systems (IDS/IPS) and sandboxing to analyze and block malicious payloads before they reach end users. 6. Employ cryptographic verification mechanisms at the organizational level for any code or files imported into DOORS Next, if feasible, to supplement the missing integrity checks. 7. Conduct regular security audits and penetration testing focused on the software supply chain and download processes within the engineering environment. 8. Consider isolating DOORS Next environments from general user networks to contain potential compromises.