What is the CVSS score of CVE-2025-36102?

CVE-2025-36102 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2025-36102?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Controller CVE-2025-36102

EUVD-2025-201817 LOW

Client-Side Enforcement of Server-Side Security (CWE-602)

2025-12-08 psirt@us.ibm.com

Authentication Bypass IBM Cognos Controller Controller

2.7

CVSS 3.1 · Vendor: us

View

Vulnerability Assessment

Weakness	CWE CWE-602 OWASP Top 10:2025 A06:2021 - Vulnerable and Outdated Components ASVS 5.0 V14 - Configuration Dependency management, component inventory
Impact	CVSS 2.7. EPSS 0.0%. No patch confirmed.
Exploit ScenarioDerived	An attacker could send a specially crafted request to the affected application to execute arbitrary code on the underlying server, potentially gaining full control of the system.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 15, 2026

A remote code execution vulnerability (CVSS 2.7) that allows a privileged user. Remediation should follow standard vulnerability management procedures.

Earlier versions of this analysis (1)

v1 Mar 15, 2026 - 17:54 CVSS 2.7

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input into the application as trusted data, du

RemediationAI

Monitor vendor channels for patch availability.

Affected VersionsENISA

Controller 11.1.0 ≤11.1.1

Cognos Controller 11.0.0 ≤11.0.1 FP6

Affected Packages

euvd controller no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Vulnerability type: remote code execution.

Know when Controller gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (us) PRIMARY 2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (us) · only source for this CVE.

CVSS VectorVendor: us

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

DescriptionCVE.org

Executive ViewAI

Why It Matters

CVE-2025-36102 is a low-severity vulnerability (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation. Apply vendor updates when available as part of routine maintenance.

Business Impact: Low

Compensating Controls

Apply vendor patch during routine maintenance. Standard security controls provide adequate interim protection.

Threat Intelligence Overview

EPSS Score

0.0%

Top 85% exploitable

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.0%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

Low

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +14

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Controller

View all

CVE-2024-50603 CRITICAL Emergency POC

10.0 Jan 08

Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996 contains an OS command injection via improper neutralizati

CVE-2021-40870 CRITICAL Act Now POC

9.8 Sep 13

An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Rated critical severity (CVSS 9.8), this vulner

CVE-2020-26553 CRITICAL Act Now POC

9.8 Nov 17

An issue was discovered in Aviatrix Controller before R6.0.2483. Rated critical severity (CVSS 9.8), this vulnerability

CVE-2020-13417 CRITICAL Act Now POC

9.8 May 22

An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CV

CVE-2020-26548 HIGH This Week POC

8.8 Nov 17

An issue was discovered in Aviatrix Controller before R5.4.1290. Rated high severity (CVSS 8.8), this vulnerability is r

CVE-2020-26552 HIGH This Week POC

7.5 Nov 17

An issue was discovered in Aviatrix Controller before R6.0.2483. Rated high severity (CVSS 7.5), this vulnerability is r

CVE-2020-26551 HIGH This Week POC

7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.3.1151. Rated high severity (CVSS 7.5), this vulnerability is r

CVE-2020-26550 HIGH This Week POC

7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.3.1151. Rated high severity (CVSS 7.5), this vulnerability is r

CVE-2020-26549 HIGH This Week POC

7.5 Nov 17

An issue was discovered in Aviatrix Controller before R5.4.1290. Rated high severity (CVSS 7.5), this vulnerability is r

CVE-2020-13415 HIGH This Week POC

7.5 May 22

An issue was discovered in Aviatrix Controller through 5.1. Rated high severity (CVSS 7.5), this vulnerability is remote

CVE-2020-13414 HIGH This Week POC

7.5 May 22

An issue was discovered in Aviatrix Controller before 5.4.1204. Rated high severity (CVSS 7.5), this vulnerability is re

CVE-2020-13413 MEDIUM This Month POC

5.3 May 22

An issue was discovered in Aviatrix Controller before 5.4.1204. Rated medium severity (CVSS 5.3), this vulnerability is

Same weakness CWE-602 – Client-Side Enforcement of Server-Side Security

View all

CVE-2025-51682 CRITICAL POC

9.8

CVE-2025-32808 HIGH POC

7.7

CVE-2020-8162 HIGH POC

7.5

CVE-2022-3308 HIGH POC

7.4

CVE-2026-100306 MEDIUM POC

6.9

CVE-2023-42787 MEDIUM POC

6.5

CVE-2026-30521 MEDIUM POC

6.5

CVE-2026-30522 MEDIUM POC

6.5

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

References

Advisories & patches

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-36102 ADVISORY https://www.ibm.com/support/pages/node/7253273

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back