CVE-2025-36244
Ibm Vios 3.1 … 4.1
Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-36244 is a high-severity External Initialization of Trusted Variables or Data Stores (CWE-454) vulnerability in Ibm Aix. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-29617
Vulnerability Data
IBM AIX 7.2, 7.3, IBM VIOS 3.1, and 4.1, when configured to use Kerberos network authentication, could allow a local user to write to files on the system with root privileges due to improper initialization of critical variables.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V7.2.1V8.3.1V12.3.4V3.2.3
Mitigating Controls (NIST 800-53 r5) AI
Validates all information inputs before they are used to initialize internal variables or data stores.
Enforces access authorizations so untrusted actors cannot reach or modify the initialization sources for trusted variables.
Limits privileges so only authorized subjects can supply or alter values used to initialize critical internal state.
Restricts logical access and enforces approvals for changes that would allow external inputs to initialize trusted data stores.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prohibit initializing trusted variables from untrusted external inputs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards directly prohibit initializing trusted data from untrusted sources.
Security testing can detect the weakness but does not prevent it at design time.
Secure development lifecycle mandates validation of all inputs used to initialize trusted variables or data stores.
Application security requirements explicitly require protection against untrusted initialization of critical internal state.
Secure architecture principles reduce exposure of trusted variables to external inputs.
Information access restriction limits who can modify data stores but does not address initialization logic.