CVE-2025-0975
Published: 28 February 2025
Summary
CVE-2025-0975 is a high-severity Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150) vulnerability in Ibm Mq Appliance. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the improper neutralization of escape characters in IBM MQ console by requiring timely application of vendor-provided patches.
Enforces validation and sanitization of all inputs to the console component to neutralize escape characters and block code execution exploits.
Provides memory protections that prevent arbitrary code execution resulting from exploitation of the escape character neutralization flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE in IBM MQ web console directly matches exploitation of public-facing application.
NVD Description
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD console could allow an authenticated user to execute code due to improper neutralization of escape characters.
Deeper analysisAI
CVE-2025-0975 affects the console component of IBM MQ versions 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD. The vulnerability stems from improper neutralization of escape characters (CWE-150), which could allow an authenticated user to execute code. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-02-28.
An authenticated user with low privileges can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. Exploitation enables arbitrary code execution, resulting in high impacts to confidentiality, integrity, and availability on the affected system.
The IBM security advisory at https://www.ibm.com/support/pages/node/7183467 provides details on mitigation, including available patches.
Details
- CWE(s)