CVE-2025-14604
Published: 03 March 2026
Summary
CVE-2025-14604 is a medium-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Ibm Storage Scale. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 0.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2025-14604 is a vulnerability in IBM Storage Scale (versions 5.2.3.0 through 5.2.3.5 and 6.0.0.0 through 6.0.0.1) stemming from incorrect permission assignment (CWE-732). It allows a local user to unintentionally trigger additional permissions for resources, enabling those resources to be executed by unintended actors. The issue has a CVSS v3.1 base score of 6.6 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N), indicating medium severity with high impacts on confidentiality and integrity but no availability disruption.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity, though it requires user interaction (UI:R). Successful exploitation enables the attacker to execute resources with elevated permissions unintended for their access level, potentially leading to unauthorized data access (high confidentiality impact) and modification (high integrity impact).
IBM has published an advisory with details on mitigation and patches at https://www.ibm.com/support/pages/node/7262312. Security practitioners should consult this reference for version-specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208252
Vulnerability details
IBM Storage Scale IBM S through rage Scale 5.2.3.0 - 5.2.3.5, and IBM S through rage Scale 6.0.0.0 - 6.0.0.1 could allow a local user to unintentionally trigger additional permissions for resources in a way that allows that resource to…
more
be executed by unintended actors.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Incorrect permission assignment (CWE-732) allows low-privileged local users to trigger elevated execution of resources, directly enabling local privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access decisions so that resources cannot be executed by actors outside the assigned permissions, blocking the unintended permission escalation in this CVE.
Requires that only the minimum necessary permissions are granted, directly countering the incorrect permission assignment (CWE-732) that allows local users to trigger extra rights.
Mandates secure configuration settings for the storage system, including explicit file and resource permission values that would have prevented the flawed defaults in affected IBM Storage Scale versions.