What is the CVSS score of CVE-2025-1411?

CVE-2025-1411 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-1411?

Within 24 hours: Identify and inventory all deployments of IBM Security Verify Directory Container within the specified version range (10.0.0.0-10.0.3.1) and assess whether local user access exists in your environment. Within 7 days: Implement network segmentation to restrict local access to affected containers, disable unnecessary service accounts, and enforce principle of least privilege for container runtime permissions. Within 30 days: Contact IBM for patch availability and timeline; if patches become available, prioritize immediate deployment; if no patch emerges, evaluate alternative identity solutions or request extended support guidance from IBM.

Docker CVE-2025-1411

EUVD-2025-18339 HIGH

Execution with Unnecessary Privileges (CWE-250)

2025-06-15 psirt@us.ibm.com

Privilege Escalation IBM Docker Security Verify Directory

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:57 euvd

EUVD-2025-18339

Analysis Generated

Mar 14, 2026 - 21:57 vuln.today

CVE Published

Jun 15, 2025 - 13:15 nvd

HIGH 7.8

DescriptionCVE.org

IBM Security Verify Directory Container 10.0.0.0 through 10.0.3.1 could allow a local user to execute commands as root due to execution with unnecessary privileges.

AnalysisAI

IBM Security Verify Directory Container versions 10.0.0.0 through 10.0.3.1 contain a privilege escalation vulnerability allowing local users to execute arbitrary commands as root. The vulnerability stems from the application running with unnecessary elevated privileges, enabling authenticated local attackers to escalate permissions without user interaction. This is a high-severity local privilege escalation affecting containerized deployments of IBM's identity and access management solution.

Technical ContextAI

This vulnerability (CWE-250: Execution with Unnecessary Privileges) occurs in IBM Security Verify Directory Container, a containerized identity directory service component. The root cause is architectural: the application process runs with root-level privileges by default rather than using principle-of-least-privilege containerization patterns. In container environments, this is particularly dangerous as the entire container runtime gains root context. A local user with any level of access (PR:L in CVSS) can exploit improper privilege handling to break out of intended security boundaries. The CWE-250 classification indicates the developers failed to implement proper privilege separation or privilege dropping mechanisms common in Unix/Linux security practices.

RemediationAI

Immediate remediation requires upgrading to IBM Security Verify Directory Container version 10.0.4.0 or later. Organizations should: (1) Apply the latest security patch from IBM Security Advisories; (2) Implement container security context restrictions (set non-root user in Dockerfile/pod security policy, use read-only root filesystem where possible); (3) Apply pod security policies in Kubernetes deployments to prevent privileged container execution; (4) Limit local access via role-based access control and authentication hardening; (5) Run the container with explicit non-root user definitions (USER directive in container image). As an interim mitigation while patching, restrict container privileges using Docker/Kubernetes security contexts (securityContext.runAsNonRoot=true, drop ALL capabilities). Consult IBM's official security bulletin for the specific patch version number and deployment guidance.