CVE-2025-36251
Published: 13 November 2025
Summary
CVE-2025-36251 is a critical-severity Process Control (CWE-114) vulnerability in Ibm Vios. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 18.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-36251 is a high-severity vulnerability in the nimsh service SSL/TLS implementations on IBM AIX 7.2 and 7.3, as well as IBM VIOS 3.1 and 4.1. It arises from improper process controls (CWE-114), enabling a remote attacker to execute arbitrary commands. Published on 2025-11-13, this issue addresses additional attack vectors related to a vulnerability previously fixed in CVE-2024-56347. The CVSS v3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L).
A remote attacker can exploit this over the network with low attack complexity and no privileges required, though user interaction is necessary. Upon successful exploitation, the attacker achieves high confidentiality and integrity impacts, such as accessing sensitive data or modifying system behavior through arbitrary command execution, alongside low availability impact and a crossed scope that affects additional privileges or components.
IBM's security advisory at https://www.ibm.com/support/pages/node/7251173 details the vulnerability, affected versions, and recommended mitigation steps, including available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-180541
Vulnerability details
IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 nimsh service SSL/TLS implementations could allow a remote attacker to execute arbitrary commands due to improper process controls. This addresses additional attack vectors for a vulnerability that was previously…
more
addressed in CVE-2024-56347.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in nimsh service enables remote exploitation (T1210) for arbitrary command execution on AIX/VIOS Unix systems (T1059.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the specific flaw in nimsh SSL/TLS process controls by applying vendor patches as recommended in IBM's advisory.
Enforces process isolation to counter improper process controls (CWE-114) that enable remote arbitrary command execution in the nimsh service.
Minimizes attack surface by restricting the nimsh service to least functionality or disabling it if not essential, preventing exploitation vectors.