EUVD-2025-210956
GHSA-jrhp-4rrf-72w7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Network-reachable management interface (AV:N) requiring a valid low-privilege account (PR:L), no user interaction, and only partial availability loss of the email service (A:L); no C/I impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
AnalysisAI
Authenticated users on the IBM TS4300 tape library management interface can degrade the appliance's email notification service by triggering requests faster than it can handle, due to missing interaction-frequency (rate) controls in firmware versions 1.1.0.1 through 1.7.1.1. The impact is confined to availability of the email/alerting subsystem (CVSS 3.1 base 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L); the data path, stored data, and integrity are unaffected, and valid credentials are a hard prerequisite. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, making this a low-priority, patch-available hardening issue.
Technical ContextAI
CWE-799 (Improper Control of Interaction Frequency) covers the class of defects where a service accepts an unbounded or insufficiently throttled volume of requests or interactions, allowing a legitimate-but-repetitive action to exhaust resources. In CVE-2025-36045, the affected component is the email service on the IBM TS4300 tape library - the subsystem that sends administrative notifications and alerts. Because the firmware (CPE cpe:2.3:a:ibm:ts4300, all versions from 1.1.0.1 through 1.7.1.1) does not enforce rate limiting on how often the email function can be invoked, an authenticated operator can drive the service into an unresponsive state. The vulnerability is reached over the network (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but requires valid credentials (PR:L) on the management interface, and the scope is unchanged (S:U) with no confidentiality or integrity impact - only a partial availability loss (A:L). This is a classic single-subsystem resource-exhaustion flaw rather than a privilege-escalation or code-execution primitive, and it does not touch the tape data path or backup integrity.
RemediationAI
Apply the vendor-released firmware update from IBM - the patch and the precise fixed level are documented in the IBM Support bulletin at https://www.ibm.com/support/pages/node/7287022 (Patch available from vendor). Because the issue only manifests after authentication, the most effective interim compensating control is to strictly limit who holds credentials on the TS4300 management interface and to restrict network reachability to that interface to trusted administrative VLANs or jump hosts - a firewall/ACL change that removes any remote path to the email function, at the cost of losing out-of-band management access. If the email/alerting feature is not operationally required, disable or deconfigure outbound email notification on the appliance; this eliminates the vulnerable surface entirely but silences administrative alerts, so pair it with an alternative monitoring channel (SNMP polling or syslog collection) before doing so. There is no indication of an unauthenticated attack path, so no data-path workaround is necessary; the residual risk of delaying the patch is limited to temporary loss of the notification subsystem by a trusted insider.
Same weakness CWE-799 – Improper Control of Interaction Frequency
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today