CVE-2025-36192: ds8a00 firmware 10.1.3.0, 10.2.45.0, 10.10.106.0; +4 more affected products

Affected technology

ds8a00 firmware · 10.1.3.0
ibm

ds8a00 firmware · 10.2.45.0
ibm

ds8a00 firmware · 10.10.106.0
ibm

ds8900f firmware · 89.40.83.0
ibm

ds8900f firmware · 89.42.18.0
ibm

ds8900f firmware · 89.44.5.0
ibm

DS8A00( R10.1) · 10.10.106.0
IBM

DS8A00 ( R10.0) · 10.1.3.0, 10.2.45.0
IBM

DS8900F ( R9.4) · 89.40.83.0, 89.42.18.0, 89.44.5.0
IBM

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · No privileges required · No user interaction required

Attack conditions (NVD, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

A local user with authorized CCW update permissions could delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms. Vendor/CNA’s CVSS 3.1 assessment (base score 6.7/10) rates confidentiality impact as none; integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.1/10) rates confidentiality impact as none; integrity and availability impact as high.