CVE-2025-36251 is a critical remote code execution vulnerability affecting the nimsh service's SSL/TLS implementations in IBM AIX versions 7.2 and 7.3, and IBM VIOS versions 3.1 and 4.1. With a CVSS score of 9.8 (CRITICAL), this flaw allows an unauthenticated remote attacker to execute arbitrary commands due to improper process controls. While there is no known active exploitation, publicly available exploit code, or KEV listing, the vulnerability has garnered some community discussion, indicating awareness. Organizations using affected IBM products should prioritize patching as soon as advisories are released.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
3.1.0CPE matchmatch criteria | cpe:2.3:a:ibm:vios:3.1.0:*:*:*:*:*:*:* | ||
4.1.0CPE matchmatch criteria | cpe:2.3:a:ibm:vios:4.1.0:*:*:*:*:*:*:* | ||
7.2CPE matchmatch criteria | cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:* | ||
7.3CPE matchmatch criteria | cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.