EUVD-2025-18994Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands.
AnalysisAI
IBM QRadar SIEM versions 7.5 through 7.5.0 Update Package 12 contains a privilege escalation vulnerability that allows authenticated administrative users to modify configuration files and upload malicious autoupdate packages, leading to arbitrary command execution with system-level privileges. This is a high-severity vulnerability (CVSS 9.1) affecting SIEM infrastructure; while it requires high privileges (PR:H), the network-accessible attack vector (AV:N) and lack of user interaction (UI:N) make it a significant risk in multi-user enterprise environments where administrative credentials may be compromised or misused.
Technical ContextAI
The vulnerability exploits improper input validation in IBM QRadar's autoupdate mechanism (CWE-73: External Control of File Name or Path). QRadar's configuration management and update delivery system fails to properly validate or restrict privileged users' ability to modify configuration files that control the autoupdate process. Specifically, an authenticated administrator can manipulate update package metadata or installation paths to inject and execute arbitrary code during the autoupdate routine, which typically runs with elevated system privileges. This affects QRadar SIEM 7.5.x deployments (CPE: cpe:2.3:a:ibm:qradar_security_information_and_event_management:7.5*), where the autoupdate feature is a core component for deploying security patches and feature updates. The root cause is the lack of cryptographic validation, file integrity checks, or path canonicalization in the update installation logic.
RemediationAI
Upgrade IBM QRadar SIEM to version 7.5.0 Update Package 13 or later; priority: CRITICAL; timeline: Immediate (within 24-48 hours) Interim Mitigation (if patching delayed): Restrict administrative access to QRadar configuration and autoupdate mechanisms; implement role-based access control (RBAC) to limit which admin accounts can modify update settings; monitor configuration file modifications and autoupdate logs for unauthorized changes; priority: HIGH Detection: Enable and review QRadar audit logs for configuration file modifications (especially update-related configs), monitor system process execution logs for unexpected commands spawned during autoupdate cycles, set alerts on autoupdate package installation anomalies Reference: Consult IBM Security Bulletin and QRadar release notes for detailed patch availability and verification steps; check IBM's official security advisories portal for CVE-2025-33117
IBM Security QRadar SIEM 7.2 and 7.3 could allow a user to bypass authentication which could lead to code execution. Rat
IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecur
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. Rated high severity (CVSS 8.
IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a local user to gain escalated privileges due to weak file permissions. Ra
IBM QRadar 7.3.0 to 7.3.3 Patch 2 contains hard-coded credentials, such as a password or cryptographic key, which it use
Unspecified vulnerability in IBM Security QRadar SIEM 7.1 MR2 and 7.2 MR2 allows remote attackers to execute arbitrary c
IBM QRadar 7.3.0 to 7.3.3 Patch 2 is vulnerable to Server Side Request Forgery (SSRF). Rated medium severity (CVSS 6.3),
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to send a specially crafted command which would be e
IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. Rated hi
IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute
IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow an authenticated user to access data and perform unauthorized actions due
Same weakness CWE-73 – External Control of File Name or Path
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today