CVE-2025-36251 - Vulnerability Details - OpenCVE

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Ibm	Aix Vios

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7251173

History

Thu, 13 Nov 2025 22:15:00 +0000

Type	Values Removed	Values Added
Description		IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
Title		AIX Command Execution
First Time appeared		Ibm Ibm aix Ibm vios
Weaknesses		CWE-114
CPEs		cpe:2.3:a:ibm:vios:3.1:::::::* cpe:2.3:a:ibm:vios:4.1:::::::* cpe:2.3:o:ibm:aix:7.2:::::::* cpe:2.3:o:ibm:aix:7.3:::::::*
Vendors & Products		Ibm Ibm aix Ibm vios
References		https://www.ibm.com/support/pages/node/7251173
Metrics		cvssV3_1 `{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-11-13T22:01:13.345Z

Updated: 2025-11-13T22:01:13.345Z

Reserved: 2025-04-15T21:16:44.886Z

Link: CVE-2025-36251

Vulnrichment

No data.

NVD

Status : Received

Published: 2025-11-13T22:15:51.053

Modified: 2025-11-13T22:15:51.053

Link: CVE-2025-36251

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-36251", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T21:16:44.886Z", "datePublished": "2025-11-13T22:01:13.345Z", "dateUpdated": "2025-11-13T22:01:13.345Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*"], "product": "AIX", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}]}, {"cpes": ["cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*"], "product": "VIOS", "vendor": "IBM", "versions": [{"status": "affected", "version": "3.1"}, {"status": "affected", "version": "4.1"}]}], "credits": [{"lang": "en", "type": "finder", "value": "These vulnerabilities were reported to IBM by Oneconsult AG (https://oneconsult.com/), Jan Alsenz."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.</p>"}], "value": "IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-114", "description": "CWE-114 Process Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-11-13T22:01:13.345Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7251173"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7251173\">https://www.ibm.com/support/pages/node/7251173</a></span><br>"}], "value": "IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin:\u00a0 https://www.ibm.com/support/pages/node/7251173"}], "title": "AIX Command Execution", "x_generator": {"engine": "ibm-cvegen"}}}}