IBM TS4500 Library CVE-2025-36061

Exploitation requires an authenticated low-privilege account on the appliance (CVSS PR:L) and the ability to send specially crafted SMTP requests to the library's email/notification management interface - the SMTP notification functionality must be reachable and the attacker must already possess valid credentials. Affected firmware is IBM Storage TS4500 / Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3. Limiting factors: authentication is mandatory (not a pre-auth flaw), impact is confined to availability (no data disclosure or modification), and the attack surface is an internal storage-management appliance rather than a broadly internet-exposed service, so realistic risk is dominated by insider or post-compromise scenarios.

This is a moderate, not top-tier, priority. The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects a network-reachable, low-complexity attack that nonetheless requires an authenticated low-privilege account (PR:L) and yields only an availability impact (A:H) with no confidentiality or integrity loss - consistent with the CWE-770 unbounded resource consumption weakness. No EPSS score, SSVC decision, or KEV listing was provided in the input, and there is no indication of public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The absence of EPSS/KEV data means widespread or automated exploitation cannot be inferred; the authentication requirement further narrows the realistic threat to insiders or attackers who have already obtained valid library credentials. Net: a genuine availability risk worth patching on this appliance, but the authentication barrier, pure-DoS impact, and lack of any exploitation signal place it below internet-facing unauthenticated RCE-class issues in priority.

An attacker holding a valid low-privilege account on an IBM Storage TS4500 or Diamondback tape library issues specially crafted SMTP requests to the management interface. The malformed requests trigger excessive consumption of system resources (CWE-770), degrading or halting the library's management functions and causing a denial of service. No public proof-of-concept exploit was identified in the provided data.