CVE-2025-36137
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
IBM Sterling Connect:Direct for UNIX command execution
IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Sterling Connect:Direct for Unix
- Vendor
- IBM
- Product
- Sterling Connect:Direct for Unix
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.2.0.7 | affected | semver | Unavailable | 6.2.0.9 iFix004 | None listed |
| 6.4.0.0 | affected | semver | Unavailable | 6.4.0.2 iFix001 | None listed |
| 6.3.0.2 | affected | semver | Unavailable | 6.3.0.5 iFix002 | None listed |