← Back

CVE-2025-36254

nvd nist
Published: Aug 19, 2026Modified: Sep 29, 2026

JSON object

Loading...
7.4
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Exploitability: 2.2 / Impact: 5.2
Source: psirt@us.ibm.com (Secondary)

Description

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an attacker to bypass security authentication due to improperly encoding of DSCLI command output to obtain sensitive information or cause a denial of service.

Affected (2)

Ibm
2 products
Ds8900f Firmware
Ds8a00 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ds8900f Firmware
89.40.83.0 ≤ version ≤ 89.44.25.0
Running on/withPlatform Versions
Ibm
Ds8900f
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ds8a00 Firmware
10.1.3.0 ≤ version ≤ 10.11.35.0
Running on/withPlatform Versions
Ibm
Ds8a00
All versions

Related CWEs

CWE-116
Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

References (1)

Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.