CVE-2025-36192: Missing Authorization with the DS8900F and DS8A00 Hardware Management Console

Published Dec 18, 2025
·
Updated

IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missing authorization in IBM Safeguarded Copy / GDPS Logical corruption protection mechanisms.

Affected Software

14 affected components
IBM DS8A00>=10.1.3.010.2.45.0<=10.10.106.0
IBM DS8900F
IBM System Storage DS8000
All of the following
IBM Ds8a00 Firmware=10.10.106.0
IBM DS8A00=10.1
All of the following
Any of the following
IBM Ds8a00 Firmware=10.1.3.0
IBM Ds8a00 Firmware=10.2.45.0
IBM DS8A00=10.0
All of the following
Any of the following
IBM Ds8a00 Firmware=89.40.83.0
IBM Ds8a00 Firmware=89.42.18.0
IBM Ds8a00 Firmware=89.44.5.0
IBM DS8A00=9.4
IBM DS8A00( R10.0 - R10.1 )<=10.1.3.0 - 10.10.106.0
IBM DS8900F ( R9.4)<=89.40.83.0-89.44.5.0

Remediation

Information

DS8A00 fixes are delivered in Microcode Bundle 10.11.30.0 R10.1.1   DS8900F fixes are delivered in Microcode Bundle 89.44.17.0 R9.4 SP4.2   DS8A00 customers should either schedule Remote Code Load (RCL) via https://www.ibm.com/support/pages/ibm-remote-code-load  or contact IBM support, and request that 10.11.30.0 be applied to their systems.DS8900F customers should either schedule Remote Code Load (RCL) via https://www.ibm.com/support/pages/ibm-remote-code-load  or contact IBM support, and request that 89.44.17.0 be applied to their systems. ICS Installation Guidelines: The ICS(es) listed below remediate critical severity vulnerabilities a) ICS CVE_4Q2025_v1.0.iso includes remediation for CVE-2024-52533 , CVE-2025-49796 , CVE-2025-49794 and is available for DS8900F and DS8A00. b) ICS CVE_4Q2025_v1.1.iso includes remediation for CVE-2025-23048 and is available for DS8900F and DS8A00. DS8900Fsystem with R9.4 LIC bundle but below 89.44.17.0 or DS8A00 with R10.0 LIC bundle but below 10.11.30.0 are recommended to install both of the above mentioned ICS(es). Customers should should either contact Remote Code Load (RCL) via https://www.ibm.com/support/pages/ibm-remote-code-load  or contact IBM support to load the above mentioned ICS(es). Note: The above ICS(es) are not supported for DS8900F with LIC bundle below R9.4. Customers should either contact Remote Code Load (RCL) via https://www.ibm.com/support/pages/ibm-remote-code-load  or contact IBM support to load the recommended or latest LIC bundle on the DS8900F system.

Event History

Dec 18, 2025
CVE Published
via IBM·12:00 AM
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software
Dec 26, 2025
CVE Published
via MITRE·01:58 PM
Data Sourced
via MITRE·01:58 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·02:15 PM
DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-36192?

CVE-2025-36192 has a medium severity due to the potential for local users to delete or corrupt critical backups.

2

How do I fix CVE-2025-36192?

To fix CVE-2025-36192, update your IBM DS8A00 and DS8900F systems to the latest available firmware that addresses this issue.

3

Which IBM products are affected by CVE-2025-36192?

CVE-2025-36192 affects IBM DS8A00 versions R10.1 and R10.0, and IBM DS8900F version R9.4.

4

What type of users are impacted by CVE-2025-36192?

Local users with authorized CCW update permissions can exploit CVE-2025-36192 to delete or corrupt backups.

5

What are the consequences of CVE-2025-36192?

The consequences of CVE-2025-36192 include possible data loss due to unauthorized backup deletion or corruption.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203