CVE-2025-36222

{
  "id": "CVE-2025-36222",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-11T21:15:34.350",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions."
    },
    {
      "lang": "es",
      "value": "IBM Fusion 2.2.0 hasta 2.10.1, IBM Fusion HCI 2.2.0 hasta 2.10.0, e IBM Fusion HCI para watsonx 2.8.2 hasta 2.10.0 utilizan configuraciones predeterminadas inseguras que podrían exponer AMQStreams sin autenticación del cliente, lo que podría permitir a un atacante realizar acciones no autorizadas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IBM",
          "product": "Fusion",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:storage_fusion:2.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_fusion:2.10.1:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2.2.0",
              "lessThanOrEqual": "2.10.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Fusion HCI",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:storage_fusion_hci:2.2.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_fusion_hci:2.10.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2.2.0",
              "lessThanOrEqual": "2.10.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "IBM",
          "product": "Fusion HCI for watsonx",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.8.2:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:2.10.0:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2.8.2",
              "lessThanOrEqual": "2.10.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 5.8
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-13T03:55:39.299346Z",
          "id": "CVE-2025-36222",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:storage_fusion:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.2.0",
              "versionEndExcluding": "2.11.0",
              "matchCriteriaId": "BC2A1C1E-916D-4949-8304-D5C75FADFDD2"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:storage_fusion_hci:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.2.0",
              "versionEndExcluding": "2.11.0",
              "matchCriteriaId": "41053DB8-FC1D-4E64-A596-6632F390AC48"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:ibm:storage_fusion_hci_for_watsonx:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.8.2",
              "versionEndExcluding": "2.11.0",
              "matchCriteriaId": "AF151CF6-B7C2-4A28-9D01-F04FF2DD800E"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7244646",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}