EUVD-2025-210744
GHSA-g2ch-h9hj-8fc4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Management interface is network-accessible; low-privilege account suffices (PR:L); full C/I/A reflects unrestricted storage control gained via privilege escalation.
Primary rating from Vendor (ibm).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to create a user with privileged user roles due to improper privileged defined with unsafe actions.
AnalysisAI
Privilege escalation in IBM System Storage DS8A00 (R10.0-R10.1, firmware 10.1.3.0-10.11.35.0) and IBM DS8900F (R9.4, firmware 89.40.83.0-89.44.25.0) permits low-privileged authenticated users to create accounts bearing full administrative roles, effectively seizing control of enterprise storage infrastructure. The flaw stems from CWE-267 (Privilege Defined With Unsafe Actions), where the user-management subsystem fails to enforce boundaries on the privilege levels assignable by non-administrative roles. No public exploit has been identified at time of analysis; EPSS is 0.25% (17th percentile) and SSVC records exploitation status as none, consistent with the absence of CISA KEV listing.
Technical ContextAI
IBM DS8A00 and DS8900F are high-end enterprise storage arrays deployed in mainframe and mission-critical data center environments. The vulnerability's root cause is CWE-267 (Privilege Defined With Unsafe Actions): a role or group within the storage management interface is permitted to invoke user-creation actions that include assignment of privileged role attributes, a capability that should be restricted exclusively to administrators. The CPE identifiers cpe:2.3:a:ibm:ds8a00(_r10.0_-_r10.1_) and cpe:2.3:a:ibm:ds8900f_(_r9.4) confirm the affected product lines are the R10.x and R9.4 firmware generations respectively. The flaw resides in the authorization enforcement layer of the storage management controller, where the privilege hierarchy governing role-creation operations is incorrectly scoped.
RemediationAI
Apply the vendor-released patch documented in IBM Security Advisory https://www.ibm.com/support/pages/node/7284322, which covers both DS8A00 (R10.0-R10.1) and DS8900F (R9.4) firmware lines. Consult the advisory for the specific patched firmware version numbers, as exact build identifiers are not independently confirmed in the available intelligence. While patch deployment is pending, restrict access to the storage management interface to authorized administrators only using network-level ACLs or dedicated out-of-band management VLANs, preventing low-privilege users from reaching the interface at all - this eliminates the network attack surface without affecting storage data-path operations. Additionally, audit all existing user accounts on affected systems for unauthorized privilege assignments and revoke any accounts whose role assignments cannot be verified. Note that network restriction is a compensating control, not a fix; it does not address the underlying authorization defect in the firmware.
More in Ds8A00 R10 0 R10 1
View allAuthentication bypass in IBM System Storage DS8A00 (firmware 10.1.3.0-10.11.35.0) and DS8900F (firmware 89.40.83.0-89.44
Cross-user command history exposure in IBM System Storage DS8A00 (10.1.3.0-10.11.35.0) and DS8900F (89.40.83.0-89.44.25.
Same weakness CWE-267 – Privilege Defined With Unsafe Actions
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today