What is the CVSS score of EUVD-2025-210959?

EUVD-2025-210959 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for EUVD-2025-210959?

Yes, a patch is available for EUVD-2025-210959. Update the affected software to the latest version immediately.

IBM Controller EUVD-2025-210959

| CVE-2025-36178 MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-09-18 ibm

GHSA-mcq3-jh58-5jpc

Authentication Bypass IBM Controller

5.4

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

5.4 MEDIUM

Network-reachable but requires a low-privilege authenticated account (PR:L); trivial client-side bypass (AC:L); no data disclosure (C:N) with limited integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 18, 2026 - 16:22 vuln.today

DescriptionCVE.org

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.

AnalysisAI

IBM Controller 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1 permit an authenticated low-privilege user to bypass file-size validation by tampering with client-side input, producing low integrity and availability impact without confidentiality exposure. The issue is rated CVSS 5.4 and assessed as a moderate, not a priority, issue; no public exploit identified at time of analysis. A vendor patch is available per IBM advisory, and exploitation requires a valid IBM Controller account with network access.

Technical ContextAI

CWE-1284 describes improper validation of a specified quantity in input; in this case the quantity is file size. IBM Controller trusts a client-supplied size value and does not re-enforce the limit server-side, so an authenticated user can alter the request to evade the intended restriction. The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L indicates network-reachable exploitation, low privileges required, no user interaction, unchanged scope, no confidentiality impact, and low integrity plus low availability impact. The CPE cpe:2.3:a:ibm:controller:*:*:*:*:*:*:*:* maps to IBM Controller and confirms the affected vendor/product family. The PR:L component confirms authentication is required, and the supplied data does not indicate public exploit code or CISA KEV active exploitation.

RemediationAI

Apply the vendor patch identified in IBM support page node/7287970; patch status is available from vendor, but no exact fixed version string is present in the supplied data, so confirm the correct fix level for the deployed 11.0.x or 11.1.x branch before upgrading. If immediate patching is not possible, enforce strict server-side file-size validation and maximum request body limits at a reverse proxy or WAF to reject oversized or tampered size parameters, recognizing that this can block legitimate large-file workflows; restrict access to trusted authenticated accounts and remove unnecessary low-privilege users, though this does not eliminate the bypass for valid users; and monitor for anomalous file-size parameters and unexpected upload behavior. The vendor advisory URL is https://www.ibm.com/support/pages/node/7287970.