CVE-2025-36007 (GCVE-0-2025-36007)

Vulnerability from cvelistv5 – Published: 2025-10-27 18:40 – Updated: 2025-10-28 03:56
VLAI?
Title
IBM QRadar SIEM incorrect privilege assignment
Summary
IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.
Severity ?
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-266 - Incorrect Privilege Assignment
Assigner
ibm
References
Impacted products
Vendor Product Version
IBM QRadar SIEM Affected: 7.5.0 , ≤ 7.5.0 UP13 IF02 (semver)
Create a notification for this product.
Credits
John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed,Dawid Bak
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-36007",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-27T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-28T03:56:06.382Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "QRadar SIEM",
          "vendor": "IBM",
          "versions": [
            {
              "lessThanOrEqual": "7.5.0 UP13 IF02",
              "status": "affected",
              "version": "7.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:ibm:qradar_siem:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.5.0:update_pack_13",
                  "versionStartIncluding": "7.5.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed,Dawid Bak"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script."
            }
          ],
          "value": "IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266 Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-27T18:40:16.046Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://www.ibm.com/support/pages/node/7249277"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "IBM encourages customers to update their systems promptly.\u003cbr\u003e\u003cbr\u003eProduct  Version  Fix\u003cbr\u003eIBM QRadar SIEM \u0026nbsp; 7.5.0  QRadar 7.5.0 UP14\u003cbr\u003e"
            }
          ],
          "value": "IBM encourages customers to update their systems promptly.\n\nProduct  Version  Fix\nIBM QRadar SIEM \u00a0 7.5.0  QRadar 7.5.0 UP14"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM QRadar SIEM incorrect privilege assignment",
      "x_generator": {
        "engine": "Vulnogram 0.4.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2025-36007",
    "datePublished": "2025-10-27T18:40:16.046Z",
    "dateReserved": "2025-04-15T21:16:05.533Z",
    "dateUpdated": "2025-10-28T03:56:06.382Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-36007\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2025-10-27T19:16:03.283\",\"lastModified\":\"2025-12-15T18:23:24.920\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"psirt@us.ibm.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-266\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"DACA17CC-8B71-4E71-B075-BFFB65AD989C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA60FDE5-8C40-4C7A-97CF-BA2A64BF307D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D6ADD3A-99BC-495F-9835-92D16DF18FC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C899CFD-26F5-43FA-A39E-7196E2929AD9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C534E65-D418-4A5E-B326-F449337C0408\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3F6494F-EC1B-4963-908A-88190E5BF835\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_01:*:*:*:*:*:*\",\"matchCriteriaId\":\"4779E5F6-6CA5-4EF7-8C0C-DC13362DAE45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13_interim_fix_02:*:*:*:*:*:*\",\"matchCriteriaId\":\"17894E0A-F47C-416F-99E3-26B158B5F852\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"AB518E06-00BA-48F3-8AEC-6E1E97CAA2CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_3:*:*:*:*:*:*\",\"matchCriteriaId\":\"289027A2-178C-45DE-A86F-1207F23D13B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_4:*:*:*:*:*:*\",\"matchCriteriaId\":\"5047AECF-879B-427A-ACF7-ECB10965E1B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD448AB8-E3CC-41A1-9D32-B1B35C68FA5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_6:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F4014E8-42E2-4B76-B2DA-8B50929A4AB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_7:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD0A459A-C74A-4E18-83B3-4C29D47D2C2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_8:*:*:*:*:*:*\",\"matchCriteriaId\":\"721EFDD7-EE35-430C-AF17-C54BDB10434E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_9:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C3D4D7E-0B57-47E3-BD16-5BBCE05063F5\"}]}]}],\"references\":[{\"url\":\"https://www.ibm.com/support/pages/node/7249277\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-36007\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-27T19:34:15.443107Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-27T19:34:19.372Z\"}}], \"cna\": {\"title\": \"IBM QRadar SIEM incorrect privilege assignment\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"John Zuccato, Rodney Ryan, Chris Shepherd, Vince Dragnea, Ben Goodspeed,Dawid Bak\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"IBM\", \"product\": \"QRadar SIEM\", \"versions\": [{\"status\": \"affected\", \"version\": \"7.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.5.0 UP13 IF02\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"IBM encourages customers to update their systems promptly.\\n\\nProduct  Version  Fix\\nIBM QRadar SIEM \\u00a0 7.5.0  QRadar 7.5.0 UP14\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM encourages customers to update their systems promptly.\u003cbr\u003e\u003cbr\u003eProduct  Version  Fix\u003cbr\u003eIBM QRadar SIEM \u0026nbsp; 7.5.0  QRadar 7.5.0 UP14\u003cbr\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.ibm.com/support/pages/node/7249277\", \"tags\": [\"vendor-advisory\", \"patch\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.4.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 13 Independent Fix 02 is vulnerable to privilege escalation due to improper privilege assignment to an update script.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-266\", \"description\": \"CWE-266 Incorrect Privilege Assignment\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:a:ibm:qradar_siem:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndIncluding\": \"7.5.0:update_pack_13\", \"versionStartIncluding\": \"7.5.0\"}], \"operator\": \"OR\"}], \"operator\": \"OR\"}], \"providerMetadata\": {\"orgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"shortName\": \"ibm\", \"dateUpdated\": \"2025-10-27T18:40:16.046Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-36007\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-28T03:56:06.382Z\", \"dateReserved\": \"2025-04-15T21:16:05.533Z\", \"assignerOrgId\": \"9a959283-ebb5-44b6-b705-dcc2bbced522\", \"datePublished\": \"2025-10-27T18:40:16.046Z\", \"assignerShortName\": \"ibm\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.