{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-33108", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-04-15T17:50:49.744Z", "datePublished": "2025-06-14T00:25:23.830Z", "dateUpdated": "2025-06-14T00:25:23.830Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Backup Recovery and Media Services for i", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.4, 7.5"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system."}], "value": "IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-250", "description": "CWE-250 Execution with Unnecessary Privileges", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-06-14T00:25:23.830Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7236663"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5 and 7.4 will be fixed.<br>The IBM i PTF numbers for 5770-BR1 contain the fix for the vulnerability.<br> <br>IBM i Release <br>5770-BR1 PTF Numbers<br><br>PTF Download Link<br>7.5 SJ05907 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05907\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05907</a><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05907\"></a><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05907\"></a><br>7.4 SJ05906 <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05906\">https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05906</a><br>"}], "value": "The issue can be fixed by applying a PTF to IBM i. IBM i releases 7.5 and 7.4 will be fixed.\nThe IBM i PTF numbers for 5770-BR1 contain the fix for the vulnerability.\n \nIBM i Release \n5770-BR1 PTF Numbers\n\nPTF Download Link\n7.5 SJ05907 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05907 https://www.ibm.com/mysupport/s/fix-information?legacy=SJ05906"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Backup Recovery and Media Services for i code execution", "x_generator": {"engine": "Vulnogram 0.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "IBM Backup, Recovery and Media Services for i 7.4 and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to a library unqualified call made by a BRMS program. A malicious actor could cause user-controlled code to run with component access to the host operating system."}], "id": "CVE-2025-33108", "lastModified": "2025-06-14T01:15:19.800", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 6.0, "source": "psirt@us.ibm.com", "type": "Primary"}]}, "published": "2025-06-14T01:15:19.800", "references": [{"source": "psirt@us.ibm.com", "url": "https://www.ibm.com/support/pages/node/7236663"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-250"}], "source": "psirt@us.ibm.com", "type": "Primary"}]}

{}