PT-2025-46923 · Ibm · Aix+2

Published 2025-11-13 · Updated 2025-12-23 · CVE-2025-36250

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.2 and 7.3 IBM VIOS versions 3.1 and 4.1

Description The NIM server (formerly known as NIM master) service (nimesis) in IBM AIX and IBM VIOS may allow a remote attacker to execute arbitrary commands and traverse directories on the system. An attacker could potentially send a specially crafted URL request to write arbitrary files. This issue addresses additional attack vectors for a previously addressed issue.

Recommendations IBM AIX version 7.2 IBM AIX version 7.3 IBM VIOS version 3.1 IBM VIOS version 4.1 Restrict access to the NIM server.

Fix

RCE

Weakness Enumeration

CWE-114

Related Identifiers

BDU:2025-14676

CVE-2025-36250

Affected Products

Aix

Ibm Aix

Vios

References · 23

• https://osv.dev/vulnerability/CVE-2025-36250 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14676 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-36250 · Security Note
• https://reddit.com/r/CVEWatch/comments/1p092hc/top_10_trending_cves_18112025 · Reddit Post
• https://ibm.com/support/pages/node/7251173 · Patch, Vendor Advisory
• https://twitter.com/offseq/status/1989121472376225901 · Twitter Post
• https://twitter.com/0dayPublishing/status/1989357646965604776 · Twitter Post
• https://reddit.com/r/CVEWatch/comments/1p14p4v/top_10_trending_cves_19112025 · Reddit Post
• https://twitter.com/CVEnew/status/1989194839418868054 · Twitter Post
• https://twitter.com/CrowdCyber_Com/status/1990494635240706487 · Twitter Post
• https://twitter.com/autumn_good_35/status/1989376182429856000 · Twitter Post
• https://twitter.com/guriguri_dW/status/1991334314018210273 · Twitter Post
• https://twitter.com/zoomeye_team/status/1990263006878654758 · Twitter Post
• https://t.me/pentestingnews/70990 · Telegram Post
• https://t.me/poxek/5676 · Telegram Post