CVE-2025-33112 - Vulnerability Details - OpenCVE

IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Ibm	Aix Vios

Configuration 1 [-]

OR	cpe:2.3:a:ibm:vios:4.1.1:::::::*
	cpe:2.3:o:ibm:aix:7.3.3:::::::*

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7236103

History

Fri, 25 Jul 2025 19:15:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:o:ibm:aix:-:::::::* cpe:2.3:o:ibm:aix:7.3:::::::*	cpe:2.3:o:ibm:aix:7.3.3:::::::*

Fri, 25 Jul 2025 19:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:ibm:aix:-:::::::* cpe:2.3:o:ibm:aix:7.3:::::::*

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00027}`	epss `{'score': 0.0003}`

Tue, 10 Jun 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 10 Jun 2025 16:45:00 +0000

Type	Values Removed	Values Added
Description		IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.
Title		IBM AIX command execution
First Time appeared		Ibm Ibm aix Ibm vios
Weaknesses		CWE-23
CPEs		cpe:2.3:a:ibm:vios:4.1.1:::::::* cpe:2.3:o:ibm:aix:7.2:::::::*
Vendors & Products		Ibm Ibm aix Ibm vios
References		https://www.ibm.com/support/pages/node/7236103
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-06-10T16:28:44.355Z

Updated: 2025-08-24T11:57:38.663Z

Reserved: 2025-04-15T17:50:49.744Z

Link: CVE-2025-33112

Vulnrichment

Updated: 2025-06-10T17:52:23.073Z

NVD

Status : Analyzed

Published: 2025-06-10T17:23:11.607

Modified: 2025-07-25T19:09:10.797

Link: CVE-2025-33112

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-33112", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T17:50:49.744Z", "datePublished": "2025-06-10T16:28:44.355Z", "dateUpdated": "2025-08-24T11:57:38.663Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "AIX", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.3"}]}, {"cpes": ["cpe:2.3:a:ibm:vios:4.1.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "VIOS", "vendor": "IBM", "versions": [{"status": "affected", "version": "4.1.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input."}], "value": "IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-24T11:57:38.663Z"}, "references": [{"tags": ["vendor-advisory", "patch"], "url": "https://www.ibm.com/support/pages/node/7236103"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM strongly recommends addressing the vulnerability now.<br><br> <br><br>The AIX and VIOS fixes can be downloaded via https from:<br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar\">https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar</a>"}], "value": "IBM strongly recommends addressing the vulnerability now.\n\n \n\nThe AIX and VIOS fixes can be downloaded via https from:\n\n https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM AIX command execution", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2025-33112"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-12T03:55:19.942Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-33112", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-10T17:52:17.929129Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-10T17:52:23.073Z"}}], "cna": {"title": "IBM AIX command execution", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "AIX", "versions": [{"status": "affected", "version": "7.3"}], "defaultStatus": "unaffected"}, {"cpes": ["cpe:2.3:a:ibm:vios:4.1.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "VIOS", "versions": [{"status": "affected", "version": "4.1.1"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "IBM strongly recommends addressing the vulnerability now.\n\n \n\nThe AIX and VIOS fixes can be downloaded via https from:\n\n https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar", "supportingMedia": [{"type": "text/html", "value": "IBM strongly recommends addressing the vulnerability now.<br><br> <br><br>The AIX and VIOS fixes can be downloaded via https from:<br><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar\">https://aix.software.ibm.com/aix/efixes/security/perl_fix9.tar</a>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7236103", "tags": ["vendor-advisory", "patch"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.", "supportingMedia": [{"type": "text/html", "value": "IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper neutralization of pathname input.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-23", "description": "CWE-23 Relative Path Traversal"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-08-24T11:57:38.663Z"}}}, "cveMetadata": {"cveId": "CVE-2025-33112", "state": "PUBLISHED", "dateUpdated": "2025-08-24T11:57:38.663Z", "dateReserved": "2025-04-15T17:50:49.744Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-06-10T16:28:44.355Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}