CVE-2025-36250

The vulnerability results from improper process control (CWE-114) in the NIM server service (formerly known as NIM master), running under the process name nimesis. A remote attacker, without the need for authentication and without user interaction, can send a specially crafted network request, which results in the execution of arbitrary commands in the service context. CVE-2025-36250 addresses additional attack vectors for a vulnerability that was already partially patched as part of CVE-2024-56346, meaning that the previous patch did not fully eliminate the issue.

An attacker can remotely execute arbitrary system commands without authentication, which in practice means the possibility of taking full control of the NIM server, violating data confidentiality and integrity, and causing system unavailability.

Apply patches available from the vendor in accordance with references published at https://www.ibm.com/support/pages/node/7251173. Additionally, until the patch is implemented, it is recommended to restrict network access to the nimesis service only to trusted hosts using a firewall or ACL rules at the network level.

IBM AIX 7.2 and 7.3, IBM VIOS 3.1 and 4.1 — systems running the NIM server service (nimesis)