CVE-2025-36421
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) transmits data in clear text, allowing an attacker to obtain sensitive information using man-in-the-middle techniques.
Risk Assessment
Clear-text data transmission exposes sensitive information to interception, potentially leading to credential or sensitive data leakage.
Recommendation
Enforce encryption (e.g., TLS) for all communications and apply updates that eliminate unsecured transmission.
Other vulnerabilities in IBM Controller
See all- CVE-2025-36178Medium
IBM Controller (versions 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1) could allow an authenticated user to bypass input validation due to improper validation of client-side input of file size.
- CVE-2025-1350Medium
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser.
- CVE-2025-36015Medium
IBM Controller versions 11.1.0 through 11.1.1 and IBM Cognos Controller versions 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to improper validation of a specified quantity size input.
Original NVD description (English source)
IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 transmits data in clear text that could allow an attacker to obtain sensitive information using man in the middle techniques.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS