CVE-2025-36096

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.

CVSS v3 9.0 CRITICAL

9.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.2 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7251173	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:vios:3.1.0:::::::*
	cpe:2.3:a:ibm:vios:4.1.0:::::::*
	cpe:2.3:o:ibm:aix:7.2:::::::*
	cpe:2.3:o:ibm:aix:7.3:::::::*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) IBM AIX 7.2 y 7.3 e IBM VIOS 3.1 y 4.1 almacena claves privadas de NIM utilizadas en entornos NIM de forma insegura, lo que es susceptible a acceso no autorizado por un atacante utilizando técnicas de hombre en el medio.

Information

Published : 2025-11-13 22:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-36096

Mitre link : CVE-2025-36096

CVE.ORG link : CVE-2025-36096

JSON object : View

Products Affected

ibm

aix
vios

CWE

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2025-36096", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36096", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-15T04:56:16.309377Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "AIX", "versions": [{"status": "affected", "version": "7.2"}, {"status": "affected", "version": "7.3"}]}, {"cpes": ["cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "VIOS", "versions": [{"status": "affected", "version": "3.1"}, {"status": "affected", "version": "4.1"}]}]}], "published": "2025-11-13T22:15:50.500", "references": [{"url": "https://www.ibm.com/support/pages/node/7251173", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques."}, {"lang": "es", "value": "IBM AIX 7.2 y 7.3 e IBM VIOS 3.1 y 4.1 almacena claves privadas de NIM utilizadas en entornos NIM de forma insegura, lo que es susceptible a acceso no autorizado por un atacante utilizando t\u00e9cnicas de hombre en el medio."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:vios:3.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3939ADB4-5177-45C2-9C29-932E81D27F9E"}, {"criteria": "cpe:2.3:a:ibm:vios:4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB8BDD68-E15D-460F-855E-72DF774D6A1F"}, {"criteria": "cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6791504A-A48A-4ED0-94AF-4C8A3B91516F"}, {"criteria": "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35DF3DE0-1AE4-4B25-843F-BC08DBBFDF78"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}