CVE-2025-36062
📋 TL;DR
IBM Cognos Analytics Mobile for iOS versions 1.1.0 through 1.1.22 transmits data over unencrypted network connections, potentially exposing sensitive information to attackers on the same network. This affects all users of the mobile app within the vulnerable version range who connect to Cognos Analytics servers.
💻 Affected Systems
- IBM Cognos Analytics Mobile
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercepting network traffic could capture authentication credentials, session tokens, and sensitive business intelligence data, leading to unauthorized access to Cognos Analytics systems and data exfiltration.
Likely Case
Attackers on the same network (public WiFi, corporate network) could capture transmitted data including potentially sensitive reports, dashboard content, and metadata about business operations.
If Mitigated
With proper network segmentation and encryption controls, exposure is limited to internal networks where attackers would need physical or logical network access.
🎯 Exploit Status
Exploitation requires network access to intercept traffic. No authentication needed to capture transmitted data if on same network segment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.23 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7239635
Restart Required: Yes
Instructions:
1. Open Apple App Store on iOS device. 2. Search for IBM Cognos Analytics Mobile. 3. Update to version 1.1.23 or later. 4. Restart the app after update.
🔧 Temporary Workarounds
Enforce HTTPS-only connections
allConfigure Cognos Analytics server to require HTTPS and disable HTTP connections
Use VPN for mobile connections
allRequire all mobile devices to connect through VPN when accessing Cognos Analytics
🧯 If You Can't Patch
- Restrict mobile app usage to trusted, encrypted networks only
- Implement network monitoring for unencrypted traffic to/from Cognos Analytics servers
🔍 How to Verify
Check if Vulnerable:
Check iOS device App Store for IBM Cognos Analytics Mobile version. If version is between 1.1.0 and 1.1.22 inclusive, device is vulnerable.Check Version:
Not applicable - check via iOS App Store or device settingsVerify Fix Applied:
Confirm app version is 1.1.23 or later in iOS Settings > General > iPhone Storage > IBM Cognos Analytics Mobile📡 Detection & Monitoring
Log Indicators:
- Unencrypted HTTP traffic to Cognos Analytics servers from iOS user agents
- Failed HTTPS connection attempts followed by HTTP fallback
Network Indicators:
- HTTP traffic to Cognos Analytics port 80/8080 from iOS devices
- Lack of TLS encryption in traffic patterns
SIEM Query:
source_ip IN (mobile_device_ips) AND dest_port IN (80,8080) AND dest_ip IN (cognos_servers) AND protocol='HTTP'