IBM TS4500 Library EUVD-2025-211135

Exploitation requires an authenticated account on the IBM Storage TS4500 Library management interface (PR:L) and depends on a second user having established and then logged out of a session that the system fails to invalidate (the CWE-613 defect). The attacker must obtain or retain that still-valid session identifier and the victim must perform a logout (UI:R), which materially limits exploitation to insider or multi-user environments rather than remote unauthenticated attackers. It affects versions 1.1.1.6 through 1.12.0.3; environments patched per IBM node/7292613 or running single-user administration are not realistically exploitable.

This is a genuinely moderate-severity, low-urgency issue rather than a top priority. The CVSS 3.1 base score of 5.5 (vector AV:N/AC:L/PR:L/UI:R) reflects a network-reachable management interface but requires an already-authenticated user (PR:L) and user interaction (UI:R), with only Low impact to confidentiality, integrity, and availability. The root weakness (CWE-613, insufficient session expiration - sessions are not invalidated on logout) permits a logged-in user to reuse/impersonate another user's session. No EPSS score, KEV listing, or POC was supplied in the input; there is no indication of active exploitation and no public exploit identified at time of analysis. The signals are internally consistent - this is a bounded session-management flaw on a specialized storage appliance, not a widely-wormable RCE. Note the standard caveat: EPSS, SSVC, and any exploit-maturity data were not provided, so the real-world exploitation probability cannot be quantified from the given data and is inferred to be low from the attack prerequisites alone.

An authenticated low-privilege user of the TS4500 management interface captures or retains a session identifier that remains valid after the legitimate owner logs out, then replays that session to act as the other user. Because exploitation depends on an existing valid session and a victim logout (UI:R), it is opportunistic rather than mass-exploitable. No public exploit code was identified in the provided data.