IBM EUVD-2025-19080

This vulnerability presents a HIGH real-world risk. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates: network-based attack vector (AV:N), low attack complexity (AC:L), requires low privileges (PR:L - authenticated user), no user interaction needed (UI:N), and impacts confidentiality, integrity, and availability at the highest level. The low attack complexity and requirement only for low-privilege authentication make this practical to exploit. The privilege escalation from authenticated user to administrator represents a significant impact. While specific EPSS probability data was not provided in source materials, the combination of network accessibility, low complexity, and authenticated-only requirement suggests moderate-to-high exploitation probability. The vulnerability affects multiple supported versions (7.2-7.5) spanning several years of deployments, expanding the affected install base. No indication of active exploitation in the wild or public POC availability was noted in available data, but the straightforward nature of the flaw (unqualified library call) suggests POC development would be feasible. Organizations with IBM i Facsimile Support deployments and untrusted internal network users should prioritize remediation.

An authenticated user (such as an employee with basic system access or a remote user with valid credentials) connects to an IBM i system running Facsimile Support for i. The attacker creates a malicious library object with the same name expected by the Facsimile Support component in a location earlier in the library search path (such as a shared library or user's personal library). When the Facsimile Support service or a privileged process invokes the unqualified library call, the system resolves the name to the attacker's malicious library instead of the legitimate one. This malicious library object executes with the privileges of the Facsimile Support process (typically administrator or system-level). The attacker gains the ability to execute arbitrary code with elevated privileges, potentially allowing data theft, system compromise, or lateral movement across the IBM i environment. This attack requires only a valid user account on the system (low privilege level) and can be executed without interactive user involvement, making it practical in most enterprise environments. No public POC availability was confirmed, but the attack vector is straightforward and well-understood in IBM i security research.