Fujitsu iRMC S6 up to 1.36 on M5 Redfish/WebUI authorization

Summaryinfo

A vulnerability identified as critical has been detected in Fujitsu iRMC S6 up to 1.36 on M5. The impacted element is an unknown function of the component Redfish/WebUI. Performing a manipulation results in authorization. This vulnerability is cataloged as CVE-2025-65002. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Fujitsu iRMC S6 up to 1.36 on M5. This affects some unknown functionality of the component Redfish/WebUI. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Fujitsu / Fsas Technologies iRMC S6 on M5 before 1.37S mishandles Redfish/WebUI access if the length of a username is exactly 16 characters.

The advisory is shared at security.ts.fujitsu.com. This vulnerability is uniquely identified as CVE-2025-65002 since 11/12/2025. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available.

Upgrading to version 1.37S eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-131958). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Fujitsu

Name

• iRMC S6

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29
• 1.30
• 1.31
• 1.32
• 1.33
• 1.34
• 1.35
• 1.36

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion