CVE-2025-1095: IBM Personal Communications LPE Vulnerability

CVE-2025-1095 Overview

CVE-2025-1095 is a local privilege escalation vulnerability affecting IBM Personal Communications v14 and v15. The flaw resides in a Windows service shipped with the product that improperly exposes privileged functionality to interactively logged-in users. Any low-privileged user on an affected host can execute commands in the context of NT AUTHORITY\SYSTEM. IBM published the advisory as an incomplete fix for the prior vulnerability tracked as CVE-2024-25029, meaning the original remediation did not fully close the attack surface. The issue is classified under [CWE-420] Unprotected Alternate Channel.

Critical Impact
A local, authenticated user with standard privileges can escalate to SYSTEM on any Windows workstation running IBM Personal Communications v14 or v15, gaining full control of the endpoint.

Affected Products

IBM Personal Communications 14.0.0
IBM Personal Communications 15.0.0
Microsoft Windows hosts running the affected IBM service

Discovery Timeline

2025-04-08 - CVE-2025-1095 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1095

Vulnerability Analysis

IBM Personal Communications is a terminal emulator suite used to connect Windows workstations to IBM mainframe and midrange systems. The product installs a Windows service that runs as NT AUTHORITY\SYSTEM to provide privileged functionality to user-mode components. The vulnerability arises from an unprotected communication channel between low-privileged client processes and the privileged service. Because the service does not adequately validate or restrict which local callers may invoke its privileged operations, any interactively logged-in user can send requests that the service executes with SYSTEM authority. IBM's original patch for CVE-2024-25029 addressed part of the exposure but left a bypass path that CVE-2025-1095 formally tracks.

Root Cause

The root cause is an unprotected alternate channel [CWE-420] exposed by the IBM Personal Communications Windows service. The service exposes an inter-process communication mechanism that lacks sufficient authentication and authorization controls. Because the earlier fix for CVE-2024-25029 did not fully harden the channel, an attacker can still reach the privileged command execution path from a standard user session.

Attack Vector

Exploitation requires local access with valid credentials to an interactive Windows session on the target host. The attacker interacts with the vulnerable service's IPC endpoint from user mode and submits crafted requests that the service executes as SYSTEM. No user interaction from another account is required, and no additional exploitation chain is needed once the attacker has a foothold. This is a post-compromise primitive commonly abused after initial access via phishing, credential theft, or a lower-severity remote foothold. See the IBM Support Page for vendor technical details.

// No public proof-of-concept code is available for CVE-2025-1095.
// Refer to the IBM advisory for technical remediation details.

Detection Methods for CVE-2025-1095

Indicators of Compromise

Unexpected child processes spawned by the IBM Personal Communications service running under NT AUTHORITY\SYSTEM.
Standard-user accounts triggering process creation events where the parent process is the IBM Personal Communications service binary.
Newly created services, scheduled tasks, or local administrator accounts shortly after interactive logon by a non-privileged user on a host with IBM Personal Communications installed.

Detection Strategies

Monitor Windows Security Event ID 4688 for process creation events where the parent is the IBM Personal Communications service and the child is a shell, script interpreter, or LOLBIN such as cmd.exe, powershell.exe, or rundll32.exe.
Baseline the expected behavior of the IBM Personal Communications service and alert on deviations, especially command execution or file writes to sensitive paths.
Correlate interactive logon events (Event ID 4624 type 2) from non-administrative users with subsequent SYSTEM-level process activity on the same host.

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on all endpoints running IBM Personal Communications.
Ingest Windows service, process, and authentication telemetry into a centralized SIEM or data lake for cross-host correlation.
Track the installed version of IBM Personal Communications across the fleet and flag any host still on 14.0.0 or 15.0.0 without the vendor patch.

How to Mitigate CVE-2025-1095

Immediate Actions Required

Inventory all Windows endpoints running IBM Personal Communications v14 or v15 and prioritize patch deployment.
Apply the fixed version published in the IBM security bulletin as soon as it is validated in a staging environment.
Restrict interactive logon rights on hosts running the affected product to trusted users only until patching is complete.

Patch Information

IBM has published remediation guidance at the IBM Support Page. Because CVE-2025-1095 is explicitly an incomplete fix for CVE-2024-25029, administrators must confirm they are deploying the newer build that addresses the residual bypass rather than relying on the earlier patch.

Workarounds

If patching cannot be completed immediately, consider stopping and disabling the vulnerable IBM Personal Communications Windows service on hosts where its functionality is not required.
Enforce application allowlisting to prevent low-privileged users from executing tools commonly used to interact with local IPC endpoints.
Limit interactive and Remote Desktop logon on affected hosts to administrators only, reducing the population of accounts that can trigger the LPE.

bash

# Example: query and stop the IBM Personal Communications service on Windows
sc.exe query state= all | findstr /I "Personal Communications"
sc.exe stop "<ServiceName>"
sc.exe config "<ServiceName>" start= disabled