What is the CVSS score of CVE-2025-36421?

CVE-2025-36421 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2025-36421?

Yes, a patch is available for CVE-2025-36421. Update the affected software to the latest version immediately.

IBM Controller CVE-2025-36421

EUVD-2025-210960 MEDIUM

Cleartext Transmission of Sensitive Information (CWE-319)

2026-09-18 ibm

GHSA-4fr9-cr7w-7w6w

Information Disclosure IBM Controller

5.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.9 MEDIUM

MITM on-path requirement justifies AC:H, no auth or interaction gives PR:N/UI:N, and cleartext exposure is confidentiality-only (C:H, I:N/A:N), matching the vendor vector.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 16:22 vuln.today

DescriptionCVE.org

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.

AnalysisAI

IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 send sensitive data in cleartext, allowing an attacker who occupies a man-in-the-middle position on the network path to capture confidential information. Exploitation requires an on-path adversary (e.g., via ARP or DNS spoofing or a compromised intermediary) but no authentication or user interaction; the CVSS 3.1 base score is 5.9 with high confidentiality impact but no integrity or availability impact. No public exploit code or confirmed active exploitation has been identified, and IBM has released a patch.

Technical ContextAI

The vulnerability is a cleartext transmission of sensitive information (CWE-319) in IBM Controller, meaning that data exchanged between Controller components-or between the Controller and other systems-is not protected by encryption such as TLS. This exposure allows an attacker with a man-in-the-middle position to passively intercept or actively relay unencrypted traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack is network-accessible but requires a high-complexity on-path position (AC:H), needs no privileges or user interaction, and results only in confidentiality loss. The CPE cpe:2.3:a:ibm:controller:*:*:*:*:*:*:*:* indicates a broad wildcard for IBM Controller, though the vendor description scopes the issue to specific fix-pack ranges. No integrity or availability impact is present.

RemediationAI

IBM has published a vendor fix; apply the appropriate patch or fix pack as directed in IBM's advisory at https://www.ibm.com/support/pages/node/7287970 (the exact fix version is not specified in the available data). As a compensating control, ensure all IBM Controller traffic-especially inter-component communication-is tunneled through TLS or a trusted VPN, which prevents cleartext capture but adds encryption overhead and requires certificate or VPN management. Additionally, segment management networks to limit attacker proximity, monitor for ARP or DNS spoofing and rogue gateways, and enforce encrypted channels between Controller components where configurable. Because exploitation requires an on-path position, reducing network exposure and using strong network access controls materially lowers risk.