CVE-2025-36254

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7284322	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ibm:ds8900f:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ibm:ds8a00:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-08-19 22:16

Updated : 2026-08-24 19:31

NVD link : CVE-2025-36254

Mitre link : CVE-2025-36254

CVE.ORG link : CVE-2025-36254

JSON object : View

Products Affected

ibm

ds8900f_firmware
ds8900f
ds8a00_firmware
ds8a00

CWE

CWE-116

Improper Encoding or Escaping of Output

{"id": "CVE-2025-36254", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-36254", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T16:17:16.111103Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:o:ibm:system_storage_ds8A00:10.1.3.0:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:system_storage_ds8A00:10.11.35.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DS8A00 (R10.0 - R10.1)", "versions": [{"status": "affected", "version": "10.1.3.0", "versionType": "semver", "lessThanOrEqual": "10.11.35.0"}]}, {"cpes": ["cpe:2.3:o:ibm:system_storage_ds8900f:89.40.83.0:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:system_storage_ds8900f:89.44.25.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "DS8900F (R9.4)", "versions": [{"status": "affected", "version": "89.40.83.0", "versionType": "semver", "lessThanOrEqual": "89.44.25.0"}]}]}], "published": "2026-08-19T22:16:36.303", "references": [{"url": "https://www.ibm.com/support/pages/node/7284322", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service."}], "lastModified": "2026-08-24T19:31:51.473", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "713AB91F-E2EE-4226-937C-9A4FC6814AA4", "versionEndIncluding": "89.44.25.0", "versionStartIncluding": "89.40.83.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:ds8900f:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "42263F4C-C8BB-4A78-AB6A-1458546961B8"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "589799B5-0AFE-49BF-8616-61DA494E1AD0", "versionEndIncluding": "10.11.35.0", "versionStartIncluding": "10.1.3.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:ds8a00:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "16A7298D-DDA7-49D5-97D2-2C3A064A7C17"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}