IBM DS8 Storage CVE-2025-36398

Exploitation requires an active authenticated session on the IBM DS8A00 or DS8900F management interface with at minimum low-privilege user rights (consistent with CVSS PR:L). The flaw is specific to the command history file handling subsystem; the attacker must be able to issue management interface requests where a filename or path parameter is accepted. Exploitation is inherently limited to environments where multiple user accounts exist on the same storage management system - in a single-administrator deployment, there are no other users' histories to target. No non-default configuration is required to be vulnerable; any multi-user deployment within the affected firmware version range is exposed. Network reachability to the management interface is required (AV:N), but no elevated privileges, special protocol, or user interaction is needed beyond the initial authenticated session.

The CVSS 3.1 score of 5.4 Medium (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) accurately reflects the bounded nature of this flaw: network-reachable, low complexity, but requiring prior authentication and producing only limited confidentiality and integrity impact with no availability effect. No EPSS score was provided in the source data, so exploitation probability cannot be quantified independently. The vulnerability is absent from CISA KEV, and no public proof-of-concept has been identified, suggesting this has not been broadly weaponized. The realistic threat model is insider abuse or lateral movement within a multi-user storage management environment - a scenario relevant even to moderately complex data center operations, where multiple administrators share access to the same storage fabric. The absence of a scope change (S:U) confirms exploitation is contained to the storage management plane and does not pivot to underlying data or host systems. Overall, this is a genuine medium-priority issue for multi-tenant or multi-admin IBM DS8 deployments, but not an emergency for single-administrator environments.

An authenticated low-privileged operator on a shared IBM DS8A00 or DS8900F management interface submits a crafted request with a manipulated filename parameter that references a different user's command history file rather than their own. The attacker reads the target user's command history to reconstruct administrative operations - potentially exposing credentials, sensitive storage configurations, or operational patterns - or overwrites the history to tamper with the audit trail and conceal prior actions.