IBM TS4500 Library CVE-2025-36252

Exploitation requires the attacker to already possess a valid authenticated session on the TS4500 management interface (PR:L), and the specific defect is that the system does not invalidate sessions, so a session identifier remains usable after it should have expired or been terminated. The concrete prerequisite is access to a reusable/non-expired session token for the library on affected firmware (1.1.1.6 through 1.12.0.3). Limiting factors: the attacker cannot act fully unauthenticated - some level of valid credentials or an active/captured session is needed - and impact is bounded to impersonating another user rather than full administrative takeover; exploitation is further constrained to organizations running the affected IBM TS4500/Diamondback tape-library firmware.

Signals are mixed and point to a moderate, authenticated-only risk rather than an urgent priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, base 6.3 Medium) describes a network-reachable but privilege-requiring flaw: an attacker must already hold a valid low-privilege authenticated session (PR:L) before the insufficient session expiration (CWE-613) can be abused to impersonate another user. No EPSS score, KEV listing, POC, or SSVC decision data was supplied in the input, so exploitation probability and active-exploitation status cannot be assessed - this is 'no public exploit identified at time of analysis.' The low C/I/A impacts and the authentication precondition keep real-world risk modest; this reads as a legitimate but non-critical issue to patch on a normal cycle rather than an emergency. Note the limited affected footprint: IBM TS4500 is specialized enterprise tape-library hardware, which further constrains mass-exploitation potential.

An attacker who already has a valid low-privilege login to the TS4500 management interface (for example a shared operator account or stolen credentials) reuses a session identifier that the system failed to invalidate after logout or timeout, allowing them to act as another, possibly higher-privileged, user. No public proof-of-concept was identified in the provided data. Because the CVSS vector is AV:N/AC:L, the action is network-reachable and technically simple once a session is held.