CVE-2025-36192CWE-862broken-access-control

CVE-2025-36192

Medium · published December 26, 2025

CVSS v3.1
6.7
EPSS
0%
Percentile
1.5
In the wild
Unconfirmed
What it is

IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00115 · 1.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-26T19:15Z
Affected products (6)
ProductVersionsFixed in
ibm/ds8a00_firmwareall versions—
ibm/ds8a00_firmwareall versions—
ibm/ds8a00_firmwareall versions—
ibm/ds8900f_firmwareall versions—
ibm/ds8900f_firmwareall versions—
ibm/ds8900f_firmwareall versions—
References (1)
https://www.ibm.com/support/pages/node/7255039 · [email protected]
EPSS history
Timeline
  • 26 DEC 13:58Z
    Missing Authorization with the DS8900F and DS8A00 Hardware Management Console
    cvelistv5