IBM DS8000 Storage CVE-2025-36254

Exploitation requires network-level reachability to the IBM DS8A00 or DS8900F DSCLI management interface, confirmed by AV:N in the CVSS vector. No prior authentication is required (PR:N), consistent with the vulnerability being an authentication bypass rather than a post-authentication flaw. The AC:H metric indicates exploitation is not trivially reproducible - the attacker must construct request conditions that specifically trigger the improper encoding path in DSCLI output processing, implying technical knowledge of the CLI's encoding format or protocol internals. Exploitation is constrained to the specific firmware version ranges: DS8A00 10.1.3.0-10.11.35.0 and DS8900F 89.40.83.0-89.44.25.0; systems running patched firmware or outside these ranges are not indicated as vulnerable. No non-default configuration appears required beyond the DSCLI interface being network-accessible, which is standard for managed storage deployments. Successful exploitation is limited by: the AC:H complexity bar, the specialized knowledge of IBM DS8000 DSCLI internals needed to craft the exploit, and the typical placement of storage management interfaces on restricted networks.

The CVSS 3.1 score of 7.4 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H reflects a network-accessible, unauthenticated attack constrained by high complexity - meaning an attacker must engineer specific request conditions to trigger the encoding misinterpretation, not simply hit an open endpoint. The dual High impact on Confidentiality and Availability with no Integrity impact aligns with an authentication bypass that grants read access to sensitive storage management data and the ability to issue disruptive commands, but not arbitrary write control. No EPSS data was present in the provided intelligence, and this CVE is absent from the CISA KEV catalog, indicating no confirmed broad exploitation. No proof-of-concept code has been identified, further reducing near-term opportunistic risk. The AC:H constraint and highly specialized target population - IBM DS8000 arrays are found primarily in large enterprise and financial-sector data centers - mean real-world exposure is concentrated but organizationally significant: a successful compromise of storage management infrastructure can undermine backup integrity, data availability, and potentially lead to downstream ransomware leverage. Organizations running the affected firmware in internet-adjacent management networks should treat this as a high-priority patch.

An attacker with network access to the DS8000 management interface sends a specially constructed DSCLI request that triggers the improper output encoding flaw, causing the downstream authentication logic to misinterpret an encoded security token and grant access without valid credentials. With authentication bypassed, the attacker reads sensitive storage configuration data - including LUN mappings, host attachments, and management credentials - or issues commands that disrupt availability of the storage array, potentially impacting all attached hosts. No public proof-of-concept has been identified; the AC:H rating indicates the attacker must have knowledge of the specific encoding behavior to engineer the bypass condition reliably.