CVE-2025-36255: DS8900F and DS8A00 Privilege Escalation
IBM System Storage DS8000 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
Other sources
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM System Storage DS8900F microcodeto a version that resolves this vulnerability.Fixed in 89.44.17.1 - Upgrade
Upgrade
IBM System Storage DS8900F microcodeto a version that resolves this vulnerability.Fixed in 89.44.25.1 - Upgrade
Upgrade
IBM System Storage DS8900F microcodeto a version that resolves this vulnerability.Fixed in 89.44.26.0 - Upgrade
Upgrade
IBM System Storage DS8900F microcodeto a version that resolves this vulnerability.Fixed in 89.45.10.0 - Upgrade
Upgrade
IBM System Storage DS8A00 microcodeto a version that resolves this vulnerability.Fixed in 10.11.34.1 - Upgrade
Upgrade
IBM System Storage DS8A00 microcodeto a version that resolves this vulnerability.Fixed in 10.12.39.0 - Configuration
Perform the microcode update via HMC as an HMC-only update; it does not require a full code update.
HMC update_scope = HMC-only
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The affected products and version ranges are IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0.
What access does an attacker gain through exploitation?
The issue could allow an authenticated user to create another user with privileged user roles. This can result in high-impact compromise of confidentiality, integrity, and availability.
Is unauthenticated remote exploitation possible?
No. The vector requires network access and low privileges, but authentication is required; user interaction is not required.