CVE-2025-0160

Published: Feb 28, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.

Affected (15)

Products: Ibm: Storage Virtualize

Ibm

1 product

Storage Virtualize

Configuration A

15 vulnerable

Vulnerable Software	Affected Versions
Ibm Storage Virtualize	From 8.5 to 8.5.0.14
Ibm Storage Virtualize	From 8.5.2.0 to 8.5.2.3
Ibm Storage Virtualize	From 8.6.0.0 to 8.6.0.6
Ibm Storage Virtualize	From 8.7.0.0 to 8.7.0.3
Ibm Storage Virtualize	Version 8.5.1.0
Ibm Storage Virtualize	Version 8.5.3.0
Ibm Storage Virtualize	Version 8.5.3.1
Ibm Storage Virtualize	Version 8.5.4.0
Ibm Storage Virtualize	Version 8.6.1.0
Ibm Storage Virtualize	Version 8.6.2.0
Ibm Storage Virtualize	Version 8.6.2.1
Ibm Storage Virtualize	Version 8.6.3.0
Ibm Storage Virtualize	Version 8.7.1.0
Ibm Storage Virtualize	Version 8.7.2.0
Ibm Storage Virtualize	Version 8.7.2.1

Related CWEs

CWE-114

Process Control

Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker.

References (1)

https://www.ibm.com/support/pages/node/7184182

Source: psirt@us.ibm.com

Vendor Advisory

Timeline

No history available yet.