IBM Concert
CVE-2025-64645
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on Concert host
-
DeliveryPlant symlink and monitor privileged file operation
-
ExploitWin TOCTOU race swapping link target
-
ExecutionPrivileged process follows attacker link
-
ImpactEscalate to Concert-level privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Requires the attacker to already have local access to a host running IBM Concert 1.0.0 through 2.1.0 and to win a race condition (CWE-367 TOCTOU) against a privileged Concert operation that resolves a symbolic link. Limiting factors: exploitation is local-only (AV:L, not remotely reachable), demands precise timing to win the symlink race (AC:H - often multiple attempts), and is constrained to platforms/versions where Concert performs the vulnerable symlink-following operation. No user interaction by a victim is needed (UI:N). |
| Impact | Signals point to a real-but-low-priority local flaw. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.4) requires local access (AV:L) and a hard-to-win race window (AC:H - TOCTOU on a symbolic link per CWE-367), which sharply limits reliable exploitation despite the high C/I/A impacts. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so this is 'no public exploit identified at time of analysis' - nothing indicates active or widespread exploitation. Note a minor tension: the description says 'local user' (implying an existing authenticated account) while the vector encodes PR:N; PR:N here reflects that no elevated privileges are needed, but a foothold on the host is still required, so effective risk is that of a local privilege-escalation primitive, not a remote unauthenticated one. Overall this is a high-CVSS-but-modest-real-risk issue: a credible local EoP for defense-in-depth patching, not an internet-facing emergency. |
| Exploit ScenarioDerived | A local user with a low-privilege account on a host running IBM Concert races a privileged Concert operation that follows a symbolic link (TOCTOU), swapping the link between the check and the use so the privileged process acts on an attacker-chosen target. Winning the race lets the attacker read, overwrite, or corrupt files with the privileges of the Concert process, yielding privilege escalation. No public proof-of-concept was identified, and the high attack complexity (AC:H) means exploitation likely requires repeated attempts to win the timing window. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Local privilege escalation in IBM Concert 1.0.0 through 2.1.0 lets an attacker who already has a foothold on the host win a symbolic-link race condition (CWE-367 TOCTOU) against a privileged Concert file operation and gain high-integrity read/write/execute capability as the service account, scored CVSS 7.4 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector is local-only with high attack complexity, so success hinges on precisely timing the symlink swap between the check and the use - often requiring repeated attempts - while no victim interaction is needed. No public exploit identified at time of analysis, there is no CISA KEV listing, and the issue is best treated as a real-but-low-priority local hardening problem pending an IBM fix.
RemediationAI
No vendor-released patch version is identified in the available data, so the first action is to monitor IBM's advisory at https://www.ibm.com/support/pages/node/7255549 for a fixed Concert release and upgrade as soon as one is published. Until then, apply compensating controls that target the symlink-following primitive: mount directories the Concert service writes to with nodev, nosuid, and where feasible noexec to blunt symlink-to-executable pivots, and ensure Concert's working, temp, and log directories are not writable by unprivileged local users - the trade-off is that relocating or tightening permissions on these paths may break service startup and should be validated in staging. Enable kernel protections fs.protected_symlinks=1 and fs.protected_hardlinks=1 (%sysctl% via /etc/sysctl.d) to block classic sticky-world-writable-directory symlink races, though these do not fully cover races inside a service-owned world-writable directory. Run the Concert service under a hardened systemd unit using PrivateTmp, ProtectSystem=strict, ProtectHome, and RestrictSUIDSGID to confine the privileged process; PrivateTmp and ProtectSystem can disrupt functions that rely on shared paths or system-wide config writes, so test before production rollout. Finally, restrict local shell/interactive access to the Concert host to a small set of trusted administrators - this does not fix the flaw but removes the local attacker position (AV:L) the exploit depends on.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-367 (Time-of-Check to Time-of-Use, TOCTOU), a race condition arising because a privileged IBM Concert process resolves and then operates on a filesystem path that a lower-privileged local user can influence via a symbolic link. If the attacker swaps a benign file for a symlink pointing at a sensitive target (for example a root-owned configuration, executable, or log/socket file) after the privileged process validates the path but before it opens, the service's elevated privileges are applied to the attacker's chosen target, yielding privilege escalation. The AC:H rating reflects the narrow timing window inherent in exploiting symlink races, and AV:L/PR:N confirms the attacker needs local execution on the host but no pre-existing Concert credentials; UI:N means no user interaction by a victim is required. The single affected CPE, cpe:2.3:a:ibm:concert:*:*:*:*:*:*:*:*, covers the product line, and the associated IBM PSIRT advisory (node/7255549) is the authoritative technical source for affected builds and fixed releases. Impact is scoped unchanged (S:U) but high on confidentiality, integrity, and availability because code running as the Concert service account - frequently with elevated filesystem and configuration privileges - can be leveraged to tamper with or disclose application and host data.
Know when Concert gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local access with a TOCTOU symlink race gives AV:L and AC:H; PR:N per vendor since no elevated rights are needed, and successful races grant full C/I/A on the target.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
IBM Concert 1.0.0 through 2.1.0 could allow a local user to escalate their privileges due to a race condition of a symbolic link.
Executive ViewAI
IBM Concert versions 1.0.0 through 2.1.0 contain a local privilege-escalation flaw that could let an attacker with an existing foothold on a host escalate to the IBM Concert service account and gain high-integrity read, write, and execute capabilities. Leadership should care because a compromised host could be used to deepen access or disrupt Concert-dependent operations, but the issue is local-only, high-complexity, and has no public exploit identified at time of analysis, making it a targeted hardening priority rather than an immediate broad-scale incident driver.
No vendor-released patch identified at time of analysis; interim mitigations include limiting local interactive access to trusted administrators, enforcing least privilege for the IBM Concert service account, restricting write access to Concert service and temporary directories, enabling OS-level symlink protection where supported, and monitoring for abnormal symlink creation or high-integrity service-account activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)NVD
Unauthenticated remote code execution in IBM Concert 1.0.0 through 3.0.0 lets any attacker who can reach the service sen
Use-after-free in IBM Concert 1.0.0 through 3.0.0 lets an attacker who can influence program input or execution flow cor
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 is vulnerable to SQL injection. Rated critical severity (CVSS 9.8)
IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Rated
Improperly scoped role-based access control in IBM Concert 1.0.0 through 3.0.0 lets any authenticated user holding even
SQL injection in IBM Concert versions 1.0.0 through 2.3.1 allows remote attackers to inject specially crafted SQL statem
Concert versions up to 2.1.0 is affected by unrestricted upload of file with dangerous type (CVSS 8.8).
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, and 1.0.2.1 could allow an authenticated user to perform unauthorized actions
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that
Local code execution in IBM Concert 1.0.0 through 2.1.0 allows an authenticated attacker to overflow a stack buffer and
Local privilege escalation in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already holds a low-privileged accoun
Heap memory corruption in IBM Concert 1.0.0 through 3.0.0 lets an attacker who already has low-privileged local access t
GitHub PoC
Exploit-DB