IBM AIX/VIOS NIM Server process control

Summaryinfo

A vulnerability labeled as very critical has been found in IBM AIX and VIOS. This vulnerability affects unknown code of the component NIM Server. The manipulation results in process control. This vulnerability is reported as CVE-2025-36250. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in IBM AIX and VIOS (the affected version unknown). It has been classified as very critical. Affected is an unknown part of the component NIM Server. The manipulation with an unknown input leads to a process control vulnerability. CWE is classifying the issue as CWE-114. Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an application to execute malicious commands (and payloads) on behalf of an attacker. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to execute arbitrary commands due to improper process controls.  This addresses additional attack vectors for a vulnerability that was previously addressed in CVE-2024-56346.

The advisory is shared for download at ibm.com. This vulnerability is traded as CVE-2025-36250 since 04/15/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/21/2025).

The vulnerability scanner Nessus provides a plugin with the ID 275719 (AIX : Multiple Vulnerabilities (IJ55968)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (275719), EUVD (EUVD-2025-180539) and CERT Bund (WID-SEC-2025-2605). Once again VulDB remains the best source for vulnerability data.

Affected

• IBM AIX

Productinfo

Type

• Operating System

Vendor

• IBM

Name

• AIX
• VIOS

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion