« Volver al listado

CVE-2025-14115

Estado: AplazadaAlta (8.4)—

IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direct for UNIX contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L sin interacción de usuario indica escalada local. Las credenciales hard-coded (CWE-798) permiten autenticación con privilegios elevados y potencial manipulación de credenciales del sistema.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Password PoliciesMulti-factor AuthenticationUser Account ManagementThreat Intelligence ProgramRestrict File and Directory PermissionsRestrict Registry Permissions

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

IBM — Sterling Connect Direct FOR UnixAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-14115",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-14115",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-21T04:55:23.620986Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:sterling_connectdirect_for_unix_container:6.3.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_connectdirect_for_unix_container:6.3.0.6:interim_fix_016:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_connectdirect_for_unix_container:6.4.0.0:*:*:*:*:*:*:*",
            "cpe:2.3:a:ibm:sterling_connectdirect_for_unix_container:6.4.0.3:interim_fix_019:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "Sterling Connect:Direct for UNIX Container",
          "versions": [
            {
              "status": "affected",
              "version": "6.3.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.3.0.6 Interim Fix 016"
            },
            {
              "status": "affected",
              "version": "6.4.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.0.3 Interim Fix 019"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-20T15:16:14.137",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7257143",
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direct for UNIX contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data."
    },
    {
      "lang": "es",
      "value": "IBM Sterling Connect:Direct para UNIX Contenedor 6.3.0.0 hasta 6.3.0.6 Arreglo Provisional 016, y 6.4.0.0 hasta 6.4.0.3 Arreglo Provisional 019 IBM® Sterling Connect:Direct para UNIX contiene credenciales codificadas de forma rígida, como una contraseña o clave criptográfica, que utiliza para su propia autenticación de entrada, comunicación de salida a componentes externos, o cifrado de datos internos."
    }
  ],
  "lastModified": "2026-06-17T08:35:21.163",
  "sourceIdentifier": "psirt@us.ibm.com"
}