VYPR
← All advisories
High severity7.2NVD Advisory· Published Oct 30, 2025· Updated Jun 17, 2026

CVE-2025-36137

CVE-2025-36137

Description

IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

9
  • IBM/Sterling Connect\7 versions
    cpe:2.3:a:ibm:sterling_connect\:direct:*:*:*:*:*:unix:*:*+ 6 more
    • cpe:2.3:a:ibm:sterling_connect\:direct:*:*:*:*:*:unix:*:*range: >=6.2.0.7,<6.2.0.9
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.2.0.9:*:-:*:*:unix:*:*
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.2.0.9:ifix004:-:*:*:unix:*:*
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.3.0.5:*:-:*:*:unix:*:*
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.3.0.5:ifix002:-:*:*:unix:*:*
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.4.0.2:*:-:*:*:unix:*:*
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.4.0.2:ifix001:-:*:*:unix:*:*
  • IBM/Sterling Connect:Direct for UNIX Containercpe-rescue2 versions
    cpe:2.3:a:ibm:sterling_connect\:direct:6.2.0.7:*:*:*:*:unix:*:*+ 1 more
    • cpe:2.3:a:ibm:sterling_connect\:direct:6.2.0.7:*:*:*:*:unix:*:*range: 6.2.0.7
    • (no CPE)range: 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.