CRITICAL🇵🇱 Wersja polska

CVE-2025-36251

CVSS 9.6v3.1pub. 2025-11-13upd. 2025-11-19

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56347.

🤖 AI Analysis
How it works

The SSL/TLS implementation in the nimsh service (Network Installation Management Service Host) contains improper process control mechanisms (CWE-114 — Process Control). An attacker can send a specially crafted network request that exploits this vulnerability to execute arbitrary system commands in the context of the service. The vulnerability is accessible remotely over the network, without requiring privileges on the attacked system, with minimal user interaction.

Impact

An attacker can remotely execute arbitrary commands on the vulnerable system, leading to complete system takeover, disclosure of confidential data, or violation of system integrity.

Mitigation & patch

Apply patches available from the vendor according to the references: https://www.ibm.com/support/pages/node/7251173

Who is affected

IBM AIX 7.2, IBM AIX 7.3, IBM VIOS 3.1, IBM VIOS 4.1

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

  • IBM Aix

    OS
    Ibm
    7.27.3

  • IBM Vios

    APP
    Ibm
    3.1.04.1.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-17118CRITICAL9.8same product

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a...

CVE-2026-17122CRITICAL9.8same product

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a...

CVE-2026-16926CRITICAL9.1same product

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due t...

CVE-2026-17040CRITICAL9.8same product

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a...

CVE-2026-17136CRITICAL9.8same product

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a...