Security Verify Directory CVE-2025-1411

The CVSS 3.1 score of 7.8 reflects significant real-world risk: AV:L (local only, reducing exposure) but AC:L (low complexity attack), PR:L (low privilege requirement), with complete impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H). This indicates that any authenticated user on the system can become root. The local attack vector naturally limits widespread exploitation compared to network-based flaws, but in containerized environments where multiple services or tenants may coexist, this becomes more practical. Without confirmed KEV/CISA status or EPSS data in the provided information, the moderate attack complexity combined with privilege requirement suggests this requires some attacker sophistication but remains highly exploitable by insiders or users with initial container access. The severity justifies prioritization for organizations running these versions, particularly in multi-tenant or security-sensitive environments.

A threat actor gains initial local access to a Kubernetes node or container host running IBM Security Verify Directory Container 10.0.2.1 (perhaps as a low-privileged service account or through a separate container breakout). Due to AC:L (low complexity), they can exploit the unnecessary root privilege execution without complex techniques—potentially through environment variable manipulation, file descriptor inheritance, or simple system calls that succeed only when run as root. Within seconds, they escalate to full root access on the container, enabling data exfiltration of identity directory contents (user credentials, access tokens), modification of authentication policies to create backdoor accounts, or denial of service by terminating critical processes. In a Kubernetes environment, a compromised directory container could propagate lateral movement across the cluster if RBAC is misconfigured.