CVE-2025-36251

Published Nov 13, 2025

Last updated 3 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36251 affects IBM AIX versions 7.2 and 7.3, as well as IBM VIOS versions 3.1 and 4.1. It involves the nimsh service SSL/TLS implementations and could allow a remote attacker to execute arbitrary commands due to improper process controls. This vulnerability introduces additional attack vectors, building upon a previously addressed vulnerability, CVE-2024-56347. Successful exploitation could allow an attacker to execute arbitrary commands remotely, potentially compromising system integrity and confidentiality, and gaining unauthorized access to affected IBM AIX and VIOS systems. The attack can be launched over a network with low complexity, requiring minimal user interaction. It is recommended to apply vendor-provided patches immediately, restrict network access to the nimsh service, and implement strict network segmentation as mitigation strategies.

Description: IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.
Source: psirt@us.ibm.com
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.6
Impact score: 6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Severity: CRITICAL

Weaknesses

psirt@us.ibm.com: CWE-114

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 10

References