CVE-2025-36118CWE-244

CVE-2025-36118

High · published November 18, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
31.5
In the wild
Unconfirmed
What it is

🚨 A seemingly innocent IKEv1 negotiation request is the key to opening a treasure trove of sensitive information! ⚡ Think of it like a waiter at a restaurant who, instead of taking your order, accidentally drops your entire meal plan for the week on the floor for everyone to see. This vulnerability lets attackers peek into device memory, gathering secrets that should be tightly guarded! If exploited, an attacker could gain unauthorized access to confidential information from the device's memory, potentially laying the groundwork for even more devastating attacks. Sensitive data could be exposed, which is absolutely devastating for any organization relying on these systems.

Put simply

Think of it like a waiter at a restaurant who, instead of taking your order, accidentally drops your entire meal plan for the week on the floor for everyone to see. This vulnerability lets attackers peek into device memory, gathering secrets that should be tightly guarded! This vulnerability in IBM Storage Virtualize versions 8.4, 8.5, 8.7, and 9.1 arises from a flaw in the IKEv1 implementation, allowing remote attackers to exploit a Security Association (SA) negotiation request to extract sensitive data from memory.

What to do

If exploited, an attacker could gain unauthorized access to confidential information from the device's memory, potentially laying the groundwork for even more devastating attacks. Sensitive data could be exposed, which is absolutely devastating for any organization relying on these systems. To safeguard your systems, immediately update to the latest patched version of IBM Storage Virtualize. Ensure to review and tighten access controls, and monitor your systems for any unusual activity. Protecting your data is a top priority! You've got this! Follow these steps and keep your data safe and sound! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00386 · 31.5th percentile
Weakness
CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')
Published
2025-11-18T02:15Z
Affected products (4)
ProductVersionsFixed in
ibm/storage_virtualizeall versions—
ibm/storage_virtualizeall versions—
ibm/storage_virtualizeall versions—
ibm/storage_virtualizeall versions—
References (1)
EPSS history
Timeline
  • 17 NOV 20:47Z
    IBM Storage Virtualize Information Disclosure
    cvelistv5