CVE-2025-36421: Multiple vulnerabilities in IBM Controller
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
Other sources
IBM Controller transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
IBM Cognos Controllerto a version that resolves this vulnerability.Fixed in 11.2 release stream - Compensating control
Apply the most recent security updates for IBM Controller (recommended in the advisory) to address multiple vulnerabilities, including clear-text transmission exposure to man-in-the-middle attacks affecting IBM Cognos Controller versions 11.0.0–11.0.1 FP7 and 11.1.0–11.1.3 FP1.
Event History
Frequently Asked Questions
What access or network position would an attacker need to exploit this issue?
An attacker would need a man-in-the-middle position on the communication path in order to intercept data transmitted in clear text.
What could an attacker obtain if exploitation succeeds?
The issue could allow an attacker to obtain sensitive information from data transmitted without encryption.