CVE-2025-0161
Published: 20 February 2025
Description
IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation.
Security Summary
CVE-2025-0161, published on 2025-02-20, affects IBM Security Verify Access Appliance versions 10.0.0.0 through 10.0.0.9 and 11.0.0.0. The vulnerability arises from improper restrictions on code generation (CWE-94), which could allow a local user to execute arbitrary code. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability through low-complexity means without requiring user interaction. Successful exploitation grants the ability to execute arbitrary code, compromising confidentiality, integrity, and availability at a high level on the affected system.
IBM provides details on mitigation and patches in its security advisory at https://www.ibm.com/support/pages/node/7183788.
Details
- CWE(s)