CVE-2025-33012: IBM Db2 Auth Bypass Vulnerability

CVE-2025-33012 Overview

CVE-2025-33012 affects IBM Db2 for Linux across versions 10.5.0 through 10.5.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3. The vulnerability allows an authenticated user to regain access after an account lockout by using a password past its expiration date. This flaw is categorized under [CWE-324] Use of a Key Past its Expiration Date. The issue weakens account lockout and credential lifecycle controls that database administrators rely on to enforce password rotation.

Critical Impact
Authenticated users can bypass account lockout protections by reusing expired passwords, regaining database access with full confidentiality, integrity, and availability impact.

Affected Products

IBM Db2 for Linux 10.5.0 through 10.5.11
IBM Db2 for Linux 11.1.0 through 11.1.4.7
IBM Db2 for Linux 11.5.0 through 11.5.9 and 12.1.0 through 12.1.3

Discovery Timeline

2025-11-07 - CVE-2025-33012 published to NVD
2025-11-19 - Last updated in NVD database

Technical Details for CVE-2025-33012

Vulnerability Analysis

IBM Db2 enforces password expiration and account lockout as independent controls. CVE-2025-33012 demonstrates that these controls do not interact correctly. A user whose account has been locked can still authenticate by presenting a password that has passed its expiration date. This contradicts the purpose of both controls and gives attackers a second authentication path after lockout policies are triggered.

An attacker who already holds low-privilege credentials can leverage this issue after triggering lockout through repeated failed attempts. Once re-authenticated, the attacker accesses database content, modifies records, and disrupts operations. The vulnerability requires network reachability to the Db2 instance and valid, though expired, credentials.

Root Cause

The root cause is improper credential lifecycle validation in the authentication path. Db2 evaluates password validity and lockout status in a sequence that allows expired credentials to satisfy the post-lockout recovery check. The product treats the expired secret as still usable for the purpose of restoring access, which falls under [CWE-324] Use of a Key Past its Expiration Date.

Attack Vector

Exploitation requires network access to the Db2 service and prior knowledge of an expired account password. The attacker submits the expired credential against an account that has entered a lockout state. The server accepts the credential and re-establishes the session. No user interaction and no elevated privileges are required beyond possession of the expired password.

No public proof-of-concept exploit is available. See the IBM Support Page for Node 7250469 for vendor technical details.

Detection Methods for CVE-2025-33012

Indicators of Compromise

Successful Db2 authentication events for accounts that recently exceeded failed login thresholds or were administratively locked.
Authentication success entries where the account password expiration date precedes the login timestamp.
Repeated failed logins followed by a sudden successful login from the same client to a Db2 instance on Linux.

Detection Strategies

Correlate Db2 db2diag.log and audit facility events to flag logins that follow lockout transitions on the same account.
Query the Db2 catalog for accounts whose PASSWORD_EXPIRATION is in the past but show recent active sessions in SYSIBMADM.APPLICATIONS.
Alert on any authentication where the credential age exceeds the configured PASSWORD_EXPIRATION policy.

Monitoring Recommendations

Forward Db2 audit logs to a centralized SIEM and build detections for lockout-then-success sequences per principal.
Track changes to LOCKED account states and review any subsequent unlock events that were not performed by an administrator.
Baseline login patterns per service account and alert on deviations from expected source hosts and times.

How to Mitigate CVE-2025-33012

Immediate Actions Required

Apply the IBM-provided fix referenced in the IBM Support Page for Node 7250469 to all affected Db2 for Linux instances.
Force password resets for all accounts that have reached or exceeded expiration on affected instances.
Restrict network access to Db2 listeners using firewall rules and allowlists until patching completes.

Patch Information

IBM has published remediation guidance for IBM Db2 10.5, 11.1, 11.5, and 12.1 on Linux. Administrators should consult the IBM Support Page for Node 7250469 for fix pack identifiers and upgrade paths that address the password-after-expiration logic.

Workarounds

Disable accounts immediately upon password expiration rather than relying on Db2 expiration enforcement.
Integrate Db2 authentication with an external identity provider that enforces credential lifecycle outside the database engine.
Reduce account lockout thresholds and require administrator unlock to remove the automatic recovery path.

bash

# Example: force password reset and lock expired accounts at the OS level
sudo passwd --expire db2user
sudo passwd --lock db2user