CVE-2025-36125
📋 TL;DR
IBM Hardware Management Console for Power systems is vulnerable to stored cross-site scripting (XSS) that allows authenticated users to inject malicious JavaScript into the web interface. This could lead to session hijacking or credential theft within trusted sessions. Affects IBM HMC Power versions 10.3.1050.0 and 11.1.1110.0.
💻 Affected Systems
- IBM Hardware Management Console - Power
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attacker steals administrator credentials, gains full control of hardware management console, and potentially compromises managed Power systems.
Likely Case
Authenticated user with malicious intent steals session cookies or credentials from other users, leading to unauthorized access.
If Mitigated
Limited impact due to authentication requirement and same-origin policy restrictions.
🎯 Exploit Status
Requires authenticated access to HMC web interface. Attacker needs to craft and inject malicious JavaScript payload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes per IBM advisory
Vendor Advisory: https://www.ibm.com/support/pages/node/7244336
Restart Required: No
Instructions:
1. Review IBM advisory 2. Apply recommended fixes from IBM 3. Verify HMC version after update
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation and output encoding for user-supplied content in HMC web interface
🧯 If You Can't Patch
- Restrict HMC access to only necessary administrative users
- Implement web application firewall with XSS protection rules
🔍 How to Verify
Check if Vulnerable:
Check HMC version via web interface or SSH: lshmc -VCheck Version:
lshmc -VVerify Fix Applied:
Verify version is updated beyond affected versions and test XSS payloads no longer execute📡 Detection & Monitoring
Log Indicators:
- Unusual JavaScript injection patterns in web logs
- Multiple failed authentication attempts followed by successful login
Network Indicators:
- Suspicious JavaScript payloads in HTTP requests to HMC
SIEM Query:
source="hmc_web_logs" AND (http_request CONTAINS "<script>" OR http_request CONTAINS "javascript:")