CVE-2025-36254

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7284322	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ibm:ds8900f:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ibm:ds8a00:-:*:*:*:*:*:*:*

History

29 Sep 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) IBM System Storage DS8A00 10.1.3.0 hasta 10.11.35.0 y IBM DS8900F 89.40.83.0 hasta 89.44.25.0 podría permitir a un atacante eludir la autenticación de seguridad debido a una codificación indebida de la salida de comandos DSCLI para obtener información sensible o causar una denegación de servicio.

Information

Published : 2026-08-19 22:16

Updated : 2026-09-29 10:10

NVD link : CVE-2025-36254

Mitre link : CVE-2025-36254

CVE.ORG link : CVE-2025-36254

JSON object : View

Products Affected

ibm

ds8900f_firmware
ds8900f
ds8a00_firmware
ds8a00

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2025-36254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T16:17:16.111103Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:o:ibm:system_storage_ds8A00:10.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:system_storage_ds8A00:10.11.35.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DS8A00 (R10.0 - R10.1)", "versions": [{"status": "affected", "version": "10.1.3.0", "versionType": "semver", "lessThanOrEqual": "10.11.35.0"}]}, {"cpes": ["cpe:2.3:o:ibm:system_storage_ds8900f:89.40.83.0:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:system_storage_ds8900f:89.44.25.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DS8900F (R9.4)", "versions": [{"status": "affected", "version": "89.40.83.0", "versionType": "semver", "lessThanOrEqual": "89.44.25.0"}]}]}], "published": "2026-08-19T22:16:36.303", "references": [{"url": "https://www.ibm.com/support/pages/node/7284322", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service."}, {"lang": "es", "value": "IBM System Storage DS8A00 10.1.3.0 hasta 10.11.35.0 y IBM DS8900F 89.40.83.0 hasta 89.44.25.0 podr\u00eda permitir a un atacante eludir la autenticaci\u00f3n de seguridad debido a una codificaci\u00f3n indebida de la salida de comandos DSCLI para obtener informaci\u00f3n sensible o causar una denegaci\u00f3n de servicio."}], "lastModified": "2026-09-29T10:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "713AB91F-E2EE-4226-937C-9A4FC6814AA4", "versionEndIncluding": "89.44.25.0", "versionStartIncluding": "89.40.83.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:ds8900f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "42263F4C-C8BB-4A78-AB6A-1458546961B8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "589799B5-0AFE-49BF-8616-61DA494E1AD0", "versionEndIncluding": "10.11.35.0", "versionStartIncluding": "10.1.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:ds8a00:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16A7298D-DDA7-49D5-97D2-2C3A064A7C17"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}