CVE-2025-12985 - Vulnerability Details - OpenCVE

IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Ibm	License Metric Tool

No data.

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/license-service-privilege-escalation-vulnerability

History

Tue, 20 Jan 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 20 Jan 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.
Title		License Service: Privilege escalation vulnerability
First Time appeared		Ibm Ibm license Metric Tool
Weaknesses		CWE-732
CPEs		cpe:2.3:a:ibm:license_metric_tool:9.0.0:::::::* cpe:2.3:a:ibm:license_metric_tool:9.0.1:::::::* cpe:2.3:a:ibm:license_metric_tool:9.1.0:::::::* cpe:2.3:a:ibm:license_metric_tool:9.2.0:::::::*
Vendors & Products		Ibm Ibm license Metric Tool
References		https://www.ibm.com/support/pages/license-service-privilege-escalation-vulnerability
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-01-20T14:50:51.912Z

Updated: 2026-01-20T15:10:40.350Z

Reserved: 2025-11-10T22:22:46.883Z

Link: CVE-2025-12985

Vulnrichment

Updated: 2026-01-20T15:10:32.622Z

NVD

Status : Received

Published: 2026-01-20T15:16:13.577

Modified: 2026-01-20T15:16:13.577

Link: CVE-2025-12985

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12985", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2025-11-10T22:22:46.883Z", "datePublished": "2026-01-20T14:50:51.912Z", "dateUpdated": "2026-01-20T15:10:40.350Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:license_metric_tool:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.2.0:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "IBM Licensing Operator", "vendor": "IBM", "versions": [{"status": "affected", "version": "9.0.0"}, {"status": "affected", "version": "9.0.1"}, {"status": "affected", "version": "9.1.0"}, {"status": "affected", "version": "9.2.0"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.</span><br>"}], "value": "IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T14:50:51.912Z"}, "references": [{"url": "https://www.ibm.com/support/pages/license-service-privilege-escalation-vulnerability"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>The fix is provided in License Service version 4.2.18.</div>"}], "value": "The fix is provided in License Service version 4.2.18."}], "source": {"discovery": "UNKNOWN"}, "title": "License Service: Privilege escalation vulnerability", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T15:10:23.287628Z", "id": "CVE-2025-12985", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:10:40.350Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12985", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T15:10:23.287628Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T15:10:32.622Z"}}], "cna": {"title": "License Service: Privilege escalation vulnerability", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:license_metric_tool:9.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:license_metric_tool:9.2.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "IBM Licensing Operator", "versions": [{"status": "affected", "version": "9.0.0"}, {"status": "affected", "version": "9.0.1"}, {"status": "affected", "version": "9.1.0"}, {"status": "affected", "version": "9.2.0"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The fix is provided in License Service version 4.2.18.", "supportingMedia": [{"type": "text/html", "value": "<div>The fix is provided in License Service version 4.2.18.</div>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/license-service-privilege-escalation-vulnerability"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Licensing Operator image.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-732", "description": "CWE-732 Incorrect Permission Assignment for Critical Resource"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-01-20T14:50:51.912Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12985", "state": "PUBLISHED", "dateUpdated": "2026-01-20T15:10:40.350Z", "dateReserved": "2025-11-10T22:22:46.883Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-01-20T14:50:51.912Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}