IBM Concert
CVE-2025-36081
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach a logged input field in IBM Concert
-
ExploitSubmit input with CRLF/control characters
-
ExecutionUnneutralized data written to system log
-
ImpactForge or corrupt log entries
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A09:2025 - Security Logging & Alerting Failures
ASVS 5.0
V16 - Security Logging and Error Handling Log output neutralization
|
| Exploitation Conditions | Exploitation requires reaching an IBM Concert input field whose value is written into system logs without neutralization of newline/CRLF or control characters (CWE-117). The vector is network-reachable (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Impact is limited to log integrity - forging, spoofing, or corrupting log entries - with no read access to data and no availability impact. Practical risk is further limited because the payoff is audit/log manipulation rather than code execution or data theft; note the description's phrase 'a user' may imply an authenticated application user despite the vector's PR:N, so the true privilege prerequisite should be confirmed with IBM. |
| Impact | This is a genuinely low-priority issue whose signals are internally consistent. The NVD CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects the reality of a CWE-117 log-injection flaw: the only impact is Integrity-Low (log tampering/forgery), with no confidentiality or availability impact. EPSS reinforces this at 0.22% (11th percentile), indicating very low predicted exploitation likelihood. There is no CISA KEV listing and no public exploit code identified, so this is not under active exploitation. The one point worth verifying: the CVSS vector states PR:N (unauthenticated) but the description says 'could allow a user to modify system logs,' which could imply an authenticated application user submitting logged input - verify the auth precondition with IBM. Bottom line: this is a low-real-risk integrity issue, not a masked critical. Log-forging is primarily useful for covering tracks, framing other actors, or corrupting audit/SIEM downstream, not for direct compromise. |
| Exploit ScenarioDerived | An attacker submits crafted input containing newline/CRLF or control characters to a field that IBM Concert writes into its system logs without neutralization. The forged entries let the attacker inject fake log lines, spoof events, or break log parsing to obscure activity or mislead investigators. No public proof-of-concept exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 26, 2026
Improper neutralization of log input in IBM Concert versions 1.0.0 through 2.0.0 allows a remote attacker to forge, spoof, or corrupt system log entries by injecting newline/CRLF or control characters into application input fields that are written verbatim into system logs. The flaw is network-reachable with low attack complexity and requires no user interaction per the assessed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), and the impact is confined to log integrity - no data confidentiality or availability loss. Overall risk is low: EPSS is only 0.22% (11th percentile), no public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV, so this is an audit-integrity nuisance rather than a code-execution or data-theft primitive.
RemediationAI
No vendor-released patch identified at time of analysis, so remediation is currently compensatory: track IBM's PSIRT advisory at https://www.ibm.com/support/pages/node/7249356 for an authorized fix level and apply it as soon as IBM publishes one. In the interim, restrict network access to IBM Concert input and API endpoints (AV:N with AC:L means reachability is the main enabler) to trusted management networks or VPN only, accepting the trade-off that legitimate remote users must route through that access path. Ingest Concert logs into a SIEM using a parser that escapes or strips CR/LF and control characters before display and correlation, and avoid rendering raw log text in terminals or admin UIs, which prevents most downstream log-forging and terminal-escape abuse at the cost of slightly less readable raw output. Segregate or make append-only the log storage and alert on unexpected log-line structure, duplicate timestamps, or entries that reference non-existent users - this raises detection cost and adds storage overhead but preserves tamper evidence. Because the CVSS vector lists PR:N while IBM's description references 'a user,' confirm the actual privilege prerequisite with the vendor and, if authentication is in fact required, tighten any unauthenticated fields that feed the logger as the highest-value quick win.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-117 (Improper Output Neutralization for Logs), a classic log-injection class in which untrusted input is passed into logging sinks without escaping newline (LF/CRLF) or other control characters. IBM Concert is a security/asset-management platform, so its own logs are a high-trust artifact consumed by SIEMs, auditors, and administrators; an attacker who can supply an input field whose value reaches those logs can split or insert synthetic log lines, spoof timestamps or severities, and potentially smuggle content into downstream log parsers (a stepping stone to log-parser attacks, though none is demonstrated here). The CPE cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:* is version-agnostic, and IBM's advisory narrows the range to 1.0.0 through 2.0.0. The assessed vector is AV:N/AC:L/PR:N/UI:N, i.e. network-reachable without user interaction, but the CVSS PR:N conflicts with IBM's description wording ('could allow a user'), which hints at an authenticated application user as a possible real prerequisite; this should be confirmed with the vendor before assuming fully unauthenticated exploitation. There is no confidentiality or availability component - the single low-integrity impact reflects tampering with log records, not the underlying managed data.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable low-complexity log injection with integrity-only impact; PR:N retained to match NVD though 'a user' wording hints authenticated access may be required.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM Concert Software
1.0.0 through 2.0.0 could allow a user to modify system logs due to improper neutralization of log input.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Affected Products (CPE)CVE.org
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
GitHub PoC
Exploit-DB