CVE-2025-36045: IBM TS4300 Email Service DoS Vulnerability

CVE-2025-36045 is a denial of service vulnerability affecting IBM TS4300 tape library systems versions 1.1.0.1 through 1.7.1.1. Authenticated users can exploit the email service to cause service disruption. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2025-36045 Overview

CVE-2025-36045 affects IBM TS4300 tape library firmware versions 1.1.0.1 through 1.7.1.1. The vulnerability allows an authenticated user to trigger a denial of service condition in the email service. The flaw stems from improper control of interaction frequency [CWE-799], enabling an attacker to abuse the email notification component beyond intended limits.

Critical Impact
An authenticated attacker with low privileges can disrupt the email notification service on the IBM TS4300, degrading the availability of alerting and administrative communication channels.

Affected Products

IBM TS4300 firmware version 1.1.0.1
IBM TS4300 firmware versions between 1.1.0.1 and 1.7.1.1
IBM TS4300 firmware version 1.7.1.1

Discovery Timeline

2026-09-18 - CVE-2025-36045 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2025-36045

Vulnerability Analysis

The vulnerability resides in the email service component of the IBM TS4300 tape library management interface. An authenticated user can invoke email-related functionality at a rate the system does not properly regulate. This lack of throttling exhausts service resources and prevents legitimate email notifications from being delivered.

The issue is classified under CWE-799: Improper Control of Interaction Frequency. This weakness class covers scenarios where a product fails to limit the number or frequency of interactions from a given actor. Attackers exploit these flaws to consume resources, bypass rate-based security controls, or degrade dependent services.

The attack is network-reachable and requires only low privileges. No user interaction is required to trigger the condition. The impact is limited to availability of the email service; confidentiality and integrity are not affected.

Root Cause

The root cause is missing or insufficient rate limiting on operations that invoke the email service. Without a bounded interaction frequency, an authenticated caller can queue or generate excessive email operations. This drives the service into an unresponsive state.

Attack Vector

An authenticated attacker sends repeated requests to the management interface that invoke the email service. Because the TS4300 does not enforce interaction frequency limits, the sustained volume of requests exhausts the service. The email notification channel becomes unavailable until the condition is cleared or the service is restarted.

Refer to the IBM Support Article for vendor-specific technical details.

Detection Methods for CVE-2025-36045

Indicators of Compromise

Sustained bursts of authenticated requests to the TS4300 management interface targeting email or notification endpoints.
Email notifications failing to deliver or arriving with significant delay from affected TS4300 devices.
Management interface logs showing repeated invocations from a single authenticated account within short time windows.

Detection Strategies

Baseline normal email notification volume from each TS4300 device and alert on deviations exceeding the baseline.
Correlate authentication events with subsequent management API activity to identify accounts issuing abnormal request patterns.
Monitor SMTP relay logs for unexpected drops, timeouts, or queue backups originating from TS4300 source addresses.

Monitoring Recommendations

Forward TS4300 audit and management logs to a centralized log platform for retention and query.
Configure alerts for repeated failed or successful invocations of the email service by a single account within a short window.
Track availability of the email notification pipeline as a service-level indicator so degradation is detected quickly.

How to Mitigate CVE-2025-36045

Immediate Actions Required

Apply the firmware update provided in the IBM Support Article for CVE-2025-36045.
Restrict management interface access to trusted administrative networks and hosts only.
Review and reduce the number of accounts with authenticated access to the TS4300 management interface.
Rotate credentials for any account suspected of being used to trigger the condition.

Patch Information

IBM has published guidance in the IBM Support Article for TS4300 firmware versions 1.1.0.1 through 1.7.1.1. Administrators should upgrade to the fixed firmware release identified in that advisory. Verify the running firmware version through the management console before and after applying the update.

Workarounds

Place the TS4300 management interface behind a network access control list that only permits administrative subnets.
Enforce authentication policies that limit account reuse and reduce the blast radius of any compromised low-privilege account.
Monitor and alert on unusual invocation patterns of the email service until the firmware update is applied.

bash

# Configuration example: restrict TS4300 management access at the network layer
# Replace TS4300_IP and ADMIN_SUBNET with values for the environment
iptables -A FORWARD -s ADMIN_SUBNET -d TS4300_IP -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d TS4300_IP -p tcp --dport 443 -j DROP