CVE-2025-11548 - Vulnerability Details - OpenCVE

A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenticated Remote Code Execution

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

No data.

References

Link	Providers
https://community.tibco.com/advisories/ibi-security-advisory-october-14-2025-ibi-webfocus-cve-2025-11548-r222/

History

Tue, 14 Oct 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 14 Oct 2025 17:00:00 +0000

Type	Values Removed	Values Added
Description		A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenticated Remote Code Execution
Title		ibi WebFOCUS - Unauthenticated RCE Vulnerability
Weaknesses		CWE-94
References		https://community.tibco.com/advisories/ibi-security-advisory-october-14-2025-ibi-webfocus-cve-2025-11548-r222/
Metrics		cvssV4_0 `{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: tibco

Published: 2025-10-14T16:45:08.673Z

Updated: 2025-10-14T19:15:39.041Z

Reserved: 2025-10-09T09:34:03.221Z

Link: CVE-2025-11548

Vulnrichment

Updated: 2025-10-14T19:15:34.367Z

NVD

Status : Awaiting Analysis

Published: 2025-10-14T17:15:35.433

Modified: 2025-10-14T19:36:29.240

Link: CVE-2025-11548

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11548", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "state": "PUBLISHED", "assignerShortName": "tibco", "dateReserved": "2025-10-09T09:34:03.221Z", "datePublished": "2025-10-14T16:45:08.673Z", "dateUpdated": "2025-10-14T19:15:39.041Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WebFOCUS", "vendor": "ibi", "versions": [{"lessThanOrEqual": "3", "status": "affected", "version": "9.1", "versionType": "Patch"}, {"lessThanOrEqual": "2", "status": "affected", "version": "9.2", "versionType": "Patch"}]}], "datePublic": "2025-10-14T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application </span><span style=\"background-color: rgb(255, 255, 255);\">which may lead to unauthenticated Remote Code Execution</span><br>"}], "value": "A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenticated Remote Code Execution"}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2025-10-14T16:45:08.673Z"}, "references": [{"url": "https://community.tibco.com/advisories/ibi-security-advisory-october-14-2025-ibi-webfocus-cve-2025-11548-r222/"}], "source": {"discovery": "UNKNOWN"}, "title": "ibi WebFOCUS - Unauthenticated RCE Vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T19:15:30.274591Z", "id": "CVE-2025-11548", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:15:39.041Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11548", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-14T19:15:30.274591Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T19:15:34.367Z"}}], "cna": {"title": "ibi WebFOCUS - Unauthenticated RCE Vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ibi", "product": "WebFOCUS", "versions": [{"status": "affected", "version": "9.1", "versionType": "Patch", "lessThanOrEqual": "3"}, {"status": "affected", "version": "9.2", "versionType": "Patch", "lessThanOrEqual": "2"}], "defaultStatus": "unaffected"}], "datePublic": "2025-10-14T16:00:00.000Z", "references": [{"url": "https://community.tibco.com/advisories/ibi-security-advisory-october-14-2025-ibi-webfocus-cve-2025-11548-r222/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may lead to unauthenticated Remote Code Execution", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application </span><span style=\"background-color: rgb(255, 255, 255);\">which may lead to unauthenticated Remote Code Execution</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "shortName": "tibco", "dateUpdated": "2025-10-14T16:45:08.673Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11548", "state": "PUBLISHED", "dateUpdated": "2025-10-14T19:15:39.041Z", "dateReserved": "2025-10-09T09:34:03.221Z", "assignerOrgId": "4f830c72-39e4-45f6-a99f-78cc01ae04db", "datePublished": "2025-10-14T16:45:08.673Z", "assignerShortName": "tibco"}, "dataVersion": "5.1"}