IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 transmit sensitive information in clear text, which violates secure communication principles (CWE-319). This flaw could enable an attacker positioned on the network path to intercept and access sensitive data without authorization. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact but no integrity or availability impact. No known exploits in the wild have been reported. The vendor has not provided explicit patch or mitigation details in the input data.

The vulnerability allows an attacker to obtain sensitive information by intercepting unencrypted network traffic between IBM Controller and its clients or servers. This compromises confidentiality but does not affect integrity or availability. The medium severity score reflects the moderate risk due to the requirement for network access and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider using network-level protections such as VPNs or encrypted tunnels to protect communications involving affected IBM Controller versions. Monitor vendor channels for updates and patches.