Sevone Network Performance Management
Monthly
Unauthenticated remote denial of service against IBM SevOne Network Performance Management 7.0.0 through 8.2.2 can exhaust server resources and degrade or halt availability (CVSS 7.5, A:H). The CVSS vector shows network reachability with no privileges and no user interaction, so any host that can reach the SevOne service is a potential attack source; confidentiality and integrity are unaffected. No public exploit was identified at time of analysis, and IBM has published a vendor patch advisory.
Local code execution in IBM SevOne Network Performance Management 7.0.0 through 8.2.2 stems from a stack-based buffer overflow that a local attacker with high privileges can use to run arbitrary code on the host. The CVSS vector (AV:L, PR:H, UI:N) confirms exploitation is neither remote nor unauthenticated: the attacker must already hold elevated access on the SevOne system, making this an impact-amplification issue rather than an entry point. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the vendor has published a fix advisory; the priority label is 'this_month', consistent with a moderate-severity, lower-urgency defect.
Unauthenticated remote denial of service against IBM SevOne Network Performance Management 7.0.0 through 8.2.2 can exhaust server resources and degrade or halt availability (CVSS 7.5, A:H). The CVSS vector shows network reachability with no privileges and no user interaction, so any host that can reach the SevOne service is a potential attack source; confidentiality and integrity are unaffected. No public exploit was identified at time of analysis, and IBM has published a vendor patch advisory.
Local code execution in IBM SevOne Network Performance Management 7.0.0 through 8.2.2 stems from a stack-based buffer overflow that a local attacker with high privileges can use to run arbitrary code on the host. The CVSS vector (AV:L, PR:H, UI:N) confirms exploitation is neither remote nor unauthenticated: the attacker must already hold elevated access on the SevOne system, making this an impact-amplification issue rather than an entry point. No public exploit code has been identified at time of analysis, the flaw is not in CISA KEV, and the vendor has published a fix advisory; the priority label is 'this_month', consistent with a moderate-severity, lower-urgency defect.