Cyber Resilience

CVE-2025-36244

Ibm Vios 3.1 … 4.1

Published
16 September 2025
Modified
17 October 2025
Patch / advisory
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 2th percentile
Risk Priority 51 floored blend · peak EPSS

Summary

CVE-2025-36244 is a high-severity External Initialization of Trusted Variables or Data Stores (CWE-454) vulnerability in Ibm Aix. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1034 Path Interception Persistence
**This technique has been deprecated.
T1574 Hijack Execution Flow Stealth
Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-25021Same product: Ibm Aix
CVE-2025-36251Same product: Ibm Aix
CVE-2025-36250Same product: Ibm Aix
CVE-2023-45171Same product: Ibm Aix
CVE-2024-27260Same product: Ibm Aix
CVE-2024-47102Same product: Ibm Aix
CVE-2025-36096Same product: Ibm Aix
CVE-2023-45170Same product: Ibm Aix
CVE-2025-33112Same product: Ibm Aix
CVE-2023-45166Same product: Ibm Aix

Affected Assets

ibm
vios
3.1, 4.1
ibm
aix
7.2, 7.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V7.2.1
  • V8.3.1
  • V12.3.4
  • V3.2.3

Mitigating Controls (NIST 800-53 r5) AI

Validates all information inputs before they are used to initialize internal variables or data stores.

Enforces access authorizations so untrusted actors cannot reach or modify the initialization sources for trusted variables.

Limits privileges so only authorized subjects can supply or alter values used to initialize critical internal state.

Restricts logical access and enforces approvals for changes that would allow external inputs to initialize trusted data stores.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prohibit initializing trusted variables from untrusted external inputs.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards directly prohibit initializing trusted data from untrusted sources.

finds

Security testing can detect the weakness but does not prevent it at design time.

prevents

Secure development lifecycle mandates validation of all inputs used to initialize trusted variables or data stores.

prevents

Application security requirements explicitly require protection against untrusted initialization of critical internal state.

prevents

Secure architecture principles reduce exposure of trusted variables to external inputs.

mitigates

Information access restriction limits who can modify data stores but does not address initialization logic.

References