{"id":"CVE-2025-36096","state":"PUBLISHED","title":"AIX Insufficiently Protected Credentials","description":"IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques.","publishedAt":"2025-11-13T22:01:22.072Z","updatedAt":"2026-02-26T16:56:58.936Z","severity":{"score":9,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","source":"ibm"},"assigner":"ibm","products":["IBM AIX","IBM VIOS"],"affected":[{"vendor":"IBM","product":"AIX","versions":[{"version":"7.2","status":"affected"},{"version":"7.3","status":"affected"}],"cpes":["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*","cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"VIOS","versions":[{"version":"3.1","status":"affected"},{"version":"4.1","status":"affected"}],"cpes":["cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*"]}],"references":["https://www.ibm.com/support/pages/node/7251173"],"weaknesses":["CWE-522"],"ingestedAt":"2026-10-29T20:09:03.054Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/36xxx/CVE-2025-36096.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-36096","state":"PUBLISHED","datePublished":"2025-11-13T22:01:22.072Z","dateUpdated":"2026-02-26T16:56:58.936Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2025-04-15T21:16:14.711Z"},"containers":{"cna":{"title":"AIX Insufficiently Protected Credentials","descriptions":[{"lang":"en","value":"IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 stores NIM private keys used in NIM environments in an insecure way which is susceptible to unauthorized access by an attacker using man in the middle techniques."}],"affected":[{"vendor":"IBM","product":"AIX","versions":[{"version":"7.2","status":"affected"},{"version":"7.3","status":"affected"}],"cpes":["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*","cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*"]},{"vendor":"IBM","product":"VIOS","versions":[{"version":"3.1","status":"affected"},{"version":"4.1","status":"affected"}],"cpes":["cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*","cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*"]}],"references":[{"url":"https://www.ibm.com/support/pages/node/7251173","tags":["vendor-advisory","patch"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-522","description":"CWE-522 Insufficiently Protected Credentials","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ibm","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateUpdated":"2025-11-13T22:01:22.072Z"},"credits":[{"lang":"en","type":"finder","value":"These vulnerabilities were reported to IBM by Oneconsult AG (https://oneconsult.com/), Jan Alsenz."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin: <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/support/pages/node/7251173\">https://www.ibm.com/support/pages/node/7251173</a></span><br>"}],"value":"IBM strongly recommends addressing the vulnerability by following the instructions in the fixes and remediation section of the IBM security bulletin:  https://www.ibm.com/support/pages/node/7251173"}],"x_generator":{"engine":"ibm-cvegen"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-36096","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2025-11-15T04:56:16.309377Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T16:56:58.936Z"}}]}}}