PT-2025-44452 · Ibm · Ibm Sterling Connect:Direct For Unix

Published 2025-10-30 · Updated 2025-10-30 · CVE-2025-36137

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect Direct for Unix versions 6.2.0.7 through 6.2.0.9 iFix004 IBM Sterling Connect Direct for Unix versions 6.3.0.2 through 6.3.0.5 iFix002 IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.2 iFix001

Description The software incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users. This could allow a privileged user to further escalate their privileges due to unnecessary privilege assignment for post update scripts.

Recommendations IBM Sterling Connect Direct for Unix versions 6.2.0.7 through 6.2.0.9 iFix004 should be updated. IBM Sterling Connect Direct for Unix versions 6.3.0.2 through 6.3.0.5 iFix002 should be updated. IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.2 iFix001 should be updated.

Fix

Weakness Enumeration

CWE-250

Related Identifiers

CVE-2025-36137

Affected Products

Ibm Sterling Connect:Direct For Unix

References · 5

• https://osv.dev/vulnerability/CVE-2025-36137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-36137 · Security Note
• https://ibm.com/support/pages/node/7249678 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1983984921967206626 · Twitter Post
• https://t.me/CVEtracker/36220 · Telegram Post