PT-2025-46924 · Ibm · Aix+2

CVE-2025-36251 · Publicado 2025-11-13 · Atualizado 2025-11-28

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM VIOS versions 3.1 and 4.1

Description The nimsh service’s SSL/TLS implementations in IBM AIX and VIOS are susceptible to improper process controls, potentially enabling a remote attacker to execute arbitrary commands. Additionally, the IBM AIX NIM server (formerly known as NIM master) service (nimesis) may allow a remote attacker to traverse directories and write arbitrary files to the system by sending a specially crafted URL request.

Recommendations IBM AIX version 7.2 IBM AIX version 7.3 IBM VIOS version 3.1 IBM VIOS version 4.1

Correção

Enumeração de Fraquezas

CWE-114

Identificadores relacionados

CVE-2025-36251

Produtos afetados

Aix

Ibm Aix

Vios

Referências · 18

• https://reddit.com/r/CVEWatch/comments/1p092hc/top_10_trending_cves_18112025 · Publicação no Reddit
• https://twitter.com/gothburz/status/1989562334268854682 · Publicação no Twitter
• https://ibm.com/support/pages/node/7251173 · Correção, Aviso do Fabricante
• https://reddit.com/r/CVEWatch/comments/1p14p4v/top_10_trending_cves_19112025 · Publicação no Reddit
• https://twitter.com/CVEnew/status/1989194841495163075 · Publicação no Twitter
• https://t.me/cveNotify/142745 · Publicação no Telegram
• https://twitter.com/transilienceai/status/1994247714834645220 · Publicação no Twitter
• https://twitter.com/autumn_good_35/status/1989376182429856000 · Publicação no Twitter
• https://twitter.com/guriguri_dW/status/1991334314018210273 · Publicação no Twitter
• https://twitter.com/zoomeye_team/status/1990263006878654758 · Publicação no Twitter
• https://t.me/poxek/5676 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-36251 · Nota de Segurança
• https://reddit.com/r/CVEWatch/comments/1ozdgd3/top_10_trending_cves_17112025 · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2025-36251 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/1989361394261570003 · Publicação no Twitter