CVE-2025-1095: IBM Personal Communications command execution
IBM Personal Communications includes a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.
Other sources
IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1095?
CVE-2025-1095 has been classified with a high severity rating due to its potential for local privilege escalation.
How do I fix CVE-2025-1095?
To fix CVE-2025-1095, you should apply the recommended patches for IBM Personal Communications versions 14.x and 15.x.
What types of systems are affected by CVE-2025-1095?
CVE-2025-1095 affects IBM Personal Communications running on Windows operating systems.
Can CVE-2025-1095 be exploited remotely?
CVE-2025-1095 cannot be exploited remotely and requires an interactively logged-in user to exploit the vulnerability.
What are the risks associated with CVE-2025-1095?
The risks of CVE-2025-1095 include unauthorized command execution with system-level privileges, leading to potential data breaches or system tampering.