CVE-2025-36137: sterling connect:direct 6.2.0.9, 6.3.0.5, 6.4.0.2; +1 more affected products

Affected technology

sterling connect:direct · from 6.2.0.7 (inclusive), before 6.2.0.9 (exclusive)
ibm

sterling connect:direct · from 6.3.0.2 (inclusive), before 6.3.0.5 (exclusive)
ibm

sterling connect:direct · from 6.4.0.0 (inclusive), before 6.4.0.2 (exclusive)
ibm

sterling connect:direct · 6.2.0.9
ibm

sterling connect:direct · 6.2.0.9 · update ifix004
ibm

sterling connect:direct · 6.3.0.5
ibm

sterling connect:direct · 6.3.0.5 · update ifix002
ibm

sterling connect:direct · 6.4.0.2
ibm

sterling connect:direct · 6.4.0.2 · update ifix001
ibm

Sterling Connect:Direct for Unix · 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, 6.3.0.2 through 6.3.0.5 iFix002
IBM

Description’s affected range: through 6.2.0.9 iFix004

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · No user interaction required

What an attacker can do

A privileged user could escalate their privileges further due to unnecessary privilege assignment for post update scripts. Vendor/CNA’s CVSS 3.1 assessment (base score 7.2/10) rates confidentiality, integrity and availability impact as high.