Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

Go to Calendar     Go to Press Room     Go to Newsletters subscription

Search

CVE-2025-36192

Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
26/12/2025
Last modified:
14/01/2026

Description

IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

Impact

Vector 3.x
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS v3.1 Severity and Metrics:

Base Score: 6.70 MEDIUM
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): High
Availability (A): High

Base Score 3.x
6.70
Severity 3.x
MEDIUM

Vulnerable products and versions

CPE From Up to
cpe:2.3:o:ibm:ds8a00_firmware:10.10.106.0:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds8a00:10.1:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:10.1.3.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:10.2.45.0:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds8a00:10.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:89.40.83.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:89.42.18.0:*:*:*:*:*:*:*
cpe:2.3:o:ibm:ds8a00_firmware:89.44.5.0:*:*:*:*:*:*:*
cpe:2.3:h:ibm:ds8a00:9.4:*:*:*:*:*:*:*

To consult the complete list of CPE names with products and versions, see this page


References to Advisories, Solutions, and Tools