by Kastro
Paper/Archive/CVE-2025-0159

CVE-2025-0159

IBM Storage Virtualize — IBM FlashSystem authentication bypass

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 58.4.584 × 2011.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.

Affected

ProductAffectedFixed inSource
Storage Virtualize8.5.0.0 – 8.5.0.13–CNA
Storage Virtualize8.5.1.0–CNA
Storage Virtualize8.5.2.0 – 8.5.2.3–CNA
Storage Virtualize8.5.3.0 – 8.5.3.1–CNA
Storage Virtualize8.5.4.0–CNA
Storage Virtualize8.6.0.0 – 8.6.0.5–CNA
Storage Virtualize8.6.1.0–CNA
Storage Virtualize8.6.2.0 – 8.6.2.1–CNA
Storage Virtualize8.6.3.0–CNA
Storage Virtualize8.7.1.0–CNA
Storage Virtualize8.7.2.0 – 8.7.2.1–CNA

Scores by source

ibm (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryibm.com/support/pages/node/7184182