CVE-2025-36255
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| IBM | DS8A00( R10.0 - R10.1 ) | 10.1.3.0 <= 10.11.35.0 | affected |
| IBM | DS8900F ( R9.4) | 89.40.83.0 <= 89.44.25.0 | affected |
Weaknesses
- CWE-267: CWE-267 Privilege Defined With Unsafe Actions
Workarounds
DS8900F and DS8A00 commonly known as DS8K is installed in client data center and clients control access to the system. DS8K offers multiple security features like LDAP, Multi-factor authentication, audit logging etc., that allows clients to control and audit personnel access to their DS8K. In addition, DS8K has implemented IBM approved challenge-response system to control IBM service personnel accessing the system either locally or remotely. So, a malicious attacker must meticulously bypass multiple layers of authentication by exploiting known open-source vulnerabilities to gain access to DS8K. The first step would be gaining access through the client infrastructure. While the issue must be mitigated at the earliest, it doesn’t pose an immediate vulnerability due to existing access controls implemented in DS8K. In addition, DS8K supports deployment of code fixes either via remote code load process or locally by IBM personnel. DS8K clients can deploy code fixes too.
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.