CVE-2025-0160
Published: 28 February 2025
Summary
CVE-2025-0160 is a high-severity Process Control (CWE-114) vulnerability in Ibm Storage Virtualize. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-7 (Boundary Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-0160 is a vulnerability in IBM FlashSystem, specifically affecting the IBM Storage Virtualize family across multiple versions, including 8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, and 8.7.2.0 through 8.7.2.1. It arises from improper restrictions in the RPCAdapter service, enabling a remote attacker with access to the system to execute arbitrary Java code. The issue is mapped to CWE-114 and has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability over the network without requiring privileges or user interaction, though exploitation demands high attack complexity. Successful attacks allow arbitrary Java code execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.
IBM provides details on mitigation and patches in its security bulletin at https://www.ibm.com/support/pages/node/7184182. Security practitioners should consult this advisory for version-specific remediation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5931
Vulnerability details
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the…
more
system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote arbitrary code execution on a network-accessible service (RPCAdapter) in a storage appliance maps cleanly to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the improper restrictions in the RPCAdapter service by identifying, testing, and applying vendor patches to prevent arbitrary Java code execution.
Monitors and controls network communications at boundaries to block remote attackers from accessing the vulnerable RPCAdapter service.
Validates inputs to the RPCAdapter service to prevent malicious payloads from triggering arbitrary Java code execution due to improper restrictions.