CVE-2025-36251

Published Nov 13, 2025

Last updated 2 months ago

IBM AIX

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36251 affects IBM AIX versions 7.2 and 7.3, as well as IBM VIOS versions 3.1 and 4.1. It involves the nimsh service SSL/TLS implementations and could allow a remote attacker to execute arbitrary commands due to improper process controls. This vulnerability introduces additional attack vectors, building upon a previously addressed vulnerability, CVE-2024-56347. Successful exploitation could allow an attacker to execute arbitrary commands remotely, potentially compromising system integrity and confidentiality, and gaining unauthorized access to affected IBM AIX and VIOS systems. The attack can be launched over a network with low complexity, requiring minimal user interaction. It is recommended to apply vendor-provided patches immediately, restrict network access to the nimsh service, and implement strict network segmentation as mitigation strategies.

Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
Source: psirt@us.ibm.com
NVD status: Analyzed
Products: vios, aix

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-114

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ibm:vios:3.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3939ADB4-5177-45C2-9C29-932E81D27F9E"
          },
          {
            "criteria": "cpe:2.3:a:ibm:vios:4.1.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AB8BDD68-E15D-460F-855E-72DF774D6A1F"
          },
          {
            "criteria": "cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6791504A-A48A-4ED0-94AF-4C8A3B91516F"
          },
          {
            "criteria": "cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "35DF3DE0-1AE4-4B25-843F-BC08DBBFDF78"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.