IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.
References
| Link | Resource |
|---|---|
| https://www.ibm.com/support/pages/node/7230335 | Vendor Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
13 Aug 2025, 00:36
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* cpe:2.3:a:ibm:personal_communications:15.0.0:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* cpe:2.3:a:ibm:personal_communications:14.0.0:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| First Time |
Linux
Microsoft windows Apple Linux linux Kernel Apple macos Ibm personal Communications Microsoft Ibm |
|
| References | () https://www.ibm.com/support/pages/node/7230335 - Vendor Advisory |
08 Apr 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-04-08 16:15
Updated : 2025-08-13 00:36
NVD link : CVE-2025-1095
Mitre link : CVE-2025-1095
JSON object : View
Products Affected
ibm
- personal_communications
microsoft
- windows
apple
- macos
linux
- linux_kernel
CWE
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer