CVE-2025-36061
MediumCVSS 6.5Summary
IBM Storage TS4500 Library and IBM Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that consume excessive amounts of system resources.
Risk Assessment
An authenticated user could overload the system with crafted SMTP requests, causing unavailability of the tape library services. This may disrupt backup and data management operations.
Recommendation
Update IBM Storage TS4500 Library to a version containing the fix that limits resource consumption by SMTP requests. Until patched, restrict access to SMTP functionality and monitor for unusual traffic.
Other vulnerabilities in IBM Storage TS4500 Library
See all- CVE-2026-19178Medium
IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileges due to a race condition.
- CVE-2025-36252Medium
IBM Storage TS4500 Library and IBM TS4500 Tape Library/Diamondback Tape Library versions 1.1.1.6 through 1.12.0.3 do not invalidate sessions, which could allow an authenticated user to impersonate another user on the system.
- CVE-2025-36069Medium
IBM Storage TS4500 Library versions 1.1.1.6 through 1.12.0.3 does not invalidate the session after logout, which could allow an authenticated user to impersonate another user on the system.
- CVE-2025-36239Medium
IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Original NVD description (English source)
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS