CVE-2025-36192— Missing Authorization with the DS8900F and DS8A00 Hardware Management Console
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-36192
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Missing Authorization with the DS8900F and DS8A00 Hardware Management Console
Source: NVD (National Vulnerability Database)
Vulnerability Description
IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制缺失
Source: NVD (National Vulnerability Database)
Vulnerability Title
IBM DS8A00和IBM DS8900F 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM DS8A00和IBM DS8900F都是美国国际商业机器（IBM）公司的一款企业存储系统。 IBM DS8A00 R10.1 10.10.106.0版本和IBM DS8900F R9.4 89.40.83.089.42.18.089.44.5.0版本存在安全漏洞，该漏洞源于IBM Safeguarded Copy和GDPS Logical corruption保护机制中缺少授权，可能导致本地用户删除或损坏备份。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| IBM | DS8A00( R10.1) | 10.10.106.0 | cpe:2.3:o:ibm:ds8900f_firmware:89.40.83.0:*:*:*:*:*:*:* | |
| IBM | DS8A00 ( R10.0) | 10.1.3.0 | - | |
| IBM | DS8900F ( R9.4) | 89.40.83.0 | - |
II. Public POCs for CVE-2025-36192
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-36192
请登录查看更多情报信息。
Same Patch Batch · IBM · 2025-12-26 · 9 CVEs total
| CVE-2025-13915 | 9.8 CRITICAL | Authentication bypass in IBM API Connect |
| CVE-2025-12771 | 7.8 HIGH | IBM Concert Software Improper Restriction of Operations within the Bounds of a Memory Buff |
| CVE-2025-64645 | 7.7 HIGH | Multiple Vulnerabilities in IBM Concert Software. |
| CVE-2025-1721 | 5.9 MEDIUM | BM Concert Software Improper Clearing of Heap Memory Before Release. |
| CVE-2025-36230 | 5.4 MEDIUM | XSS in IBM Aspera Faspex |
| CVE-2025-14687 | 4.3 MEDIUM | Client-Side Enforcement of Server-Side Security in IBM Db2 Intelligence Center |
| CVE-2025-36228 | 3.8 LOW | Incorrect Execution-Assigned Permissions in IBM Aspera Faspex |
| CVE-2025-36229 | 3.1 LOW | Exposure of Sensitive System Information to an Unauthorized Control Sphere in IBM Aspera F |
IV. Related Vulnerabilities
Same vendor: IBM
- CVE-2026-1577
IBM® Db2® is vulnerable to a denial of service with a specia - CVE-2025-36122
IBM® Db2® is vulnerable to a denial of service with a specia - CVE-2025-14688
IBM® Db2® is vulnerable to a denial of service when fetching - CVE-2026-2311
IBM i is affected by a privilege escalation vulnerability in - CVE-2025-36180
Inadequate Pod Communication Restrictions, affects watsonx.d
Same weakness: CWE-862
- CVE-2025-14755
Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Man - CVE-2021-47932
WordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthen - CVE-2025-15634
HCL BigFix WebUI is affected by a missing authorization vuln - CVE-2026-42297
Argo Workflows Is Missing Authorization in Sync ConfigMap Pr - CVE-2026-42174
Kirby: User avatar creation, replacement and deletion are no
V. Comments for CVE-2025-36192
No comments yet