CVE-2025-36069 PUBLISHED

TS4500 Tape Library Insufficient Session Expiration

Assigner: ibm
Reserved: 15.04.2025 Published: 19.10.2026 Updated: 19.10.2026

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the system.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS Score: 5.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	Required	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	IBM
Product	Storage TS4500 Library
Versions	Default: unaffected affected from 1.1.1.6 to 1.12.0.3 (incl.)

Solutions

For the 1.12.0 release, upgrade to firmware version 1.12.0.4 Fix Pack or later, available from IBM Fix Central http://www-933.ibm.com/support/fixcentral/ .

All future releases will include the fix for this vulnerability.

References

https://www.ibm.com/support/pages/node/7292613

Problem Types

CWE-613 Insufficient Session Expiration CWE