cbcvebase.
CVE-2025-0159
published 2025-02-28

CVE-2025-0159: IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5…

PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.80%
51.8th percentile
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.

Affected

20 ranges
VendorProductVersion rangeFixed in
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize——
ibmstorage_virtualize>= 8.5 < 8.5.0.148.5.0.14
ibmstorage_virtualize8.5.0.0 – 8.5.0.13—
ibmstorage_virtualize8.5.2.0 – 8.5.2.3—
ibmstorage_virtualize8.5.3.0 – 8.5.3.1—
ibmstorage_virtualize>= 8.6.0.0 < 8.6.0.68.6.0.6
ibmstorage_virtualize8.6.0.0 – 8.6.0.5—
ibmstorage_virtualize8.6.2.0 – 8.6.2.1—
ibmstorage_virtualize>= 8.7.0.0 < 8.7.0.38.7.0.3
ibmstorage_virtualize8.7.2.0 – 8.7.2.1—
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.