CVE-2025-36137

Name of the Vulnerable Software and Affected Versions IBM Sterling Connect Direct for Unix versions 6.2.0.7 through 6.2.0.9 iFix004 IBM Sterling Connect Direct for Unix versions 6.3.0.2 through 6.3.0.5 iFix002 IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.2 iFix001

Description The software incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users. This could allow a privileged user to further escalate their privileges due to unnecessary privilege assignment for post update scripts.

Recommendations IBM Sterling Connect Direct for Unix versions 6.2.0.7 through 6.2.0.9 iFix004 should be updated. IBM Sterling Connect Direct for Unix versions 6.3.0.2 through 6.3.0.5 iFix002 should be updated. IBM Sterling Connect Direct for Unix versions 6.4.0.0 through 6.4.0.2 iFix001 should be updated.