CVE-2025-36253
Ibm Concert 1.0.0 – 2.2.0
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2025-36253 is a medium-severity Use of a One-Way Hash without a Salt (CWE-759) vulnerability in Ibm Concert. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Password Cracking (T1110.002); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-36253 is a vulnerability in IBM Concert versions 1.0.0 through 2.1.0, where the software uses weaker than expected cryptographic algorithms. This flaw, published on 2026-02-02, could allow an attacker to decrypt highly sensitive information and is associated with CWE-759. The issue carries a CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
A remote attacker with no privileges or user interaction required can exploit this vulnerability over the network, though it demands high attack complexity. Successful exploitation enables the attacker to achieve high-impact confidentiality loss by decrypting highly sensitive information, with no effects on integrity or availability.
The IBM security advisory provides details on mitigation and patches at https://www.ibm.com/support/pages/node/7257565.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206789
Vulnerability Data
IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection requirements specify approved algorithms and usage that encompass salted one-way hashes for passwords.
Authenticator management requires secure credential storage practices that include salted hashes.
Developer testing and evaluation can identify missing salt values through code review or analysis.
Development standards and tools can mandate salted hashing as part of secure implementation requirements.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including salting for password hashing.
Security testing can detect unsalted hashes but does not prevent their introduction.
Secure SDLC processes can include password-handling rules but do not guarantee salted hashes.
Application security requirements can mandate salted hashing but do not prescribe the technical detail.
Secure coding standards explicitly forbid unsalted password hashes and require salting.
Secure authentication mandates salted, one-way hashes for credentials, directly preventing unsalted hashing.