IBM EUVD-2025-209038

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a local attack vector with low complexity, no privileges required, and integrity impact only. The low base score of 4.0 reflects that log tampering alone does not directly compromise confidentiality or system availability. However, the combination of no privilege requirement and local accessibility presents a practical concern in shared or multi-tenant environments. The integrity impact, though rated as low in CVSS, becomes significant if logs are used for compliance auditing, forensic investigations, or security monitoring—attackers could cover tracks or inject false evidence. Without confirmed EPSS data or known exploits in the wild, this appears to be a moderate-priority vulnerability that should be addressed during normal patch cycles but does not warrant emergency response. Organizations heavily reliant on log integrity for compliance (e.g., financial services, healthcare) should treat this with higher urgency.

A local user with shell access to a Maximo Application Suite Monitor server could craft specially formatted input containing log injection payloads (e.g., newline characters, ANSI escape sequences, or field delimiters) that, when processed by the Monitor component, are written directly to log files without sanitization. The attacker could inject fake log entries to mask unauthorized activities, alter timestamps, or insert misleading error messages that interfere with security monitoring tools that parse these logs. This attack requires local access (AV:L) but no special privileges (PR:N), making it exploitable by any user with login access to the system.