IBM CVE-2025-33108

CVSS 8.5 with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H indicates high severity with important contextual limitations: Network accessibility increases threat surface, but High attack complexity and required Low privileges (authenticated user) significantly constrain real-world exploitation. The scope change (S:C) indicates impact beyond the vulnerable component—this is a full system compromise path. Without confirmed EPSS score or KEV status, the practical risk depends heavily on: (1) How common compile/restore privileges are in typical BRMS deployments, (2) Whether this requires local system access despite AV:N rating, and (3) Insider threat probability versus external attacker capability. The privilege requirement (PR:L) suggests this is primarily an insider/lateral-movement risk rather than a remote unauthenticated attack. For organizations where BRMS administrators are security-vetted and access is tightly controlled, real-world risk is moderate; for organizations with broad compile privileges or legacy access control, risk is high. This should be treated as a medium-to-high priority based on environmental threat models, not purely on CVSS alone.

A disgruntled IT administrator or developer with compile privileges in a BRMS environment (common role in backup teams) creates a malicious ILE RPG or COBOL program object in a library such as QGPL or a custom library appearing early in the job's library list. This program contains code to exfiltrate sensitive data, create backdoor user accounts, or modify backup configurations. The administrator then triggers a BRMS restore or compilation routine that internally makes an unqualified call to a procedure (e.g., CVTSQLSTMT, QBRMS_PROCESS, or similar internal routine). The system resolves this call using the library search path and executes the malicious program instead of the legitimate BRMS component—all with the elevated privileges of the BRMS subsystem job. The attacker gains unrestricted access to the backup repository, production system objects, and can modify or delete backups. Impact: potential data theft, backup corruption, system-wide account compromise, and loss of recovery capabilities. Attack complexity is medium because the attacker must understand IBM i library resolution mechanics and have legitimate system access, but no public POC is required—this is a straightforward privilege escalation pattern on IBM i that experienced administrators would recognize.