CVE-2025-36250

Published Nov 13, 2025

Last updated 2 months ago

IBM AIX

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36250 affects IBM AIX versions 7.2 and 7.3, as well as IBM VIOS versions 3.1 and 4.1. The vulnerability lies within the NIM server (formerly known as NIM master) service, specifically nimesis. A remote attacker could exploit this vulnerability to execute arbitrary commands due to improper process controls. This CVE addresses additional attack vectors related to a vulnerability previously addressed in CVE-2024-56346. To resolve this, it is recommended to update the NIM server and VIOS to patch the improper process controls.

Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.
Source: psirt@us.ibm.com
NVD status: Analyzed
Products: vios, aix

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-114

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ibm:vios:3.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3939ADB4-5177-45C2-9C29-932E81D27F9E"
          },
          {
            "criteria": "cpe:2.3:a:ibm:vios:4.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AB8BDD68-E15D-460F-855E-72DF774D6A1F"
          },
          {
            "criteria": "cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6791504A-A48A-4ED0-94AF-4C8A3B91516F"
          },
          {
            "criteria": "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "35DF3DE0-1AE4-4B25-843F-BC08DBBFDF78"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.