IBM Sterling Connect:Direct CVE-2025-36137

Exploitation requires an authenticated Control Center Director (CCD) user account (PR:H) on an affected Sterling Connect:Direct for UNIX node, and depends on the product's maintenance-task / post-update script workflow that is granted more privileges than necessary. The limiting factors are substantial: the attacker must already hold a privileged CCD role, no path exists for an unauthenticated or low-privilege outsider, and the flaw is tied to the maintenance/post-update-script code path rather than a default runtime feature. Affected versions are 6.2.0.7 through 6.2.0.9 iFix004, 6.3.0.2 through 6.3.0.5 iFix002, and 6.4.0.0 through 6.4.0.2 iFix001; other versions are not in scope.

This is a privilege-escalation flaw (CWE-250, Execution with Unnecessary Privileges) in IBM Sterling Connect:Direct for UNIX, and the signals point to a real-but-bounded local administration risk rather than an urgent mass-exploitation threat. The published CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, C:H/I:H/A:H, score 7.2) already requires high privileges (PR:H), meaning the attacker must be an authenticated, already-privileged Control Center Director (CCD) user before any escalation is possible - this is the dominant limiting factor. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. CONFLICTING SIGNAL: the CVSS vector asserts AV:N (network), yet the description describes a privileged CCD user abusing permissions assigned for local maintenance tasks / post-update scripts, which reads as local-to-the-managed-host escalation - verify the true attack vector with IBM, as AV:N may reflect the fact that CCD administration is performed over the network. Net: a legitimately high-severity integrity/confidentiality/availability issue for organizations running the affected versions, but gated behind existing privileged access, so it is a patch-in-normal-cycle priority absent any evidence of active exploitation.

An already-privileged Control Center Director (CCD) user who should be constrained to maintenance duties leverages the unnecessary privileges granted to post-update scripts to run commands at a higher privilege level than intended, gaining full control over the Connect:Direct for UNIX node. Because exploitation requires existing high-privilege CCD access (PR:H) and no user interaction, a malicious or compromised administrator (or a lower-trust operator who should not have had this capability) is the realistic threat actor. No public proof-of-concept is referenced in the available data.