CVE-2025-0161
Published: 20 February 2025
Summary
CVE-2025-0161 is a high-severity Code Injection (CWE-94) vulnerability in Ibm Security Verify Access. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 0.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring timely identification, reporting, and patching of flaws like improper restrictions on code generation in the IBM Security Verify Access Appliance.
Mitigates code injection (CWE-94) by enforcing validation of all inputs to code generation processes, preventing local users from injecting arbitrary code.
Provides runtime memory protections such as non-executable stacks and address randomization to block arbitrary code execution even if code generation restrictions are bypassed.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local arbitrary code execution via code generation flaw directly enables use of command/scripting interpreters and exploitation for privilege escalation from low-privileged local access.
NVD Description
IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation.
Deeper analysisAI
CVE-2025-0161, published on 2025-02-20, affects IBM Security Verify Access Appliance versions 10.0.0.0 through 10.0.0.9 and 11.0.0.0. The vulnerability arises from improper restrictions on code generation (CWE-94), which could allow a local user to execute arbitrary code. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
A local attacker with low privileges can exploit this vulnerability through low-complexity means without requiring user interaction. Successful exploitation grants the ability to execute arbitrary code, compromising confidentiality, integrity, and availability at a high level on the affected system.
IBM provides details on mitigation and patches in its security advisory at https://www.ibm.com/support/pages/node/7183788.
Details
- CWE(s)