CVE-2025-13375

Published Feb 4, 2026

Last updated 5 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-13375 is a security vulnerability found in specific versions of IBM's Common Cryptographic Architecture (CCA), including versions 7.5.52 and 8.4.82. This flaw, categorized under CWE-250 for improper authorization, enables an unauthenticated attacker to execute arbitrary commands on the affected system with elevated privileges. The vulnerability allows for the bypass of authentication and authorization mechanisms, making it remotely exploitable without requiring any user interaction. The CCA acts as a software interface for IBM Hardware Security Modules (HSMs), which are designed to protect digital keys and sensitive encrypted data. Exploitation of CVE-2025-13375 could impact the confidentiality, integrity, and availability of the cryptographic card and its dependent applications, potentially leading to unauthorized data access, data modification, or disruption of system operations.

Description: IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system.
Source: psirt@us.ibm.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-250

Hype score: Not currently trending

References