CVE-2025-0160

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker with access to the system to execute arbitrary Java code due to improper restrictions in the RPCAdapter service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-114

Affected software

Vendor	Product	Versions
IBM	Storage Virtualize	>= 8.5.0.0, <= 8.5.0.13; 8.5.1.0; >= 8.5.2.0, <= 8.5.2.3; >= 8.5.3.0, <= 8.5.3.1; 8.5.4.0; >= 8.6.0.0, <= 8.6.0.5; 8.6.1.0; >= 8.6.2.0, <= 8.6.2.1; 8.6.3.0; 8.7.1.0; >= 8.7.2.0, <= 8.7.2.1

References

https://www.ibm.com/support/pages/node/7184182Vendor Advisory

Timeline

Published: Feb 28, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-01617.8IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improp CVE-2025-01627.1IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote CVE-2025-01635.3IBM Security Verify Access Appliance and Docker 10.0 through 10.0.8 could allow a remote attacker to enumerate usernames due to an observabl CVE-2025-01642.3IBM QRadar SIEM 7.5 through 7.5 Update Pack 13 Independent Fix 01 could allow a local privileged user to perform unauthorized actions on con CVE-2025-01659.8IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data 4.8.4, 4.8.5, and 5.0.0 through 5.2.0 is vulnerable to SQL injection. A remote CVE-2025-01662.7IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code i CVE-2025-01673.4When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to CVE-2025-01687.5A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse CVE-2025-01695.4The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, CVE-2025-01706.1The DWT - Directory & Listing WordPress Theme is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.3.3 due to CVE-2025-01717.5A vulnerability, which was classified as critical, was found in code-projects Chat System 1.0. Affected is an unknown function of the file /CVE-2025-01727.5A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. Affected by this vulnerability is an unknown fun