CVE-2025-36106: IBM Cognos Analytics Mobile Disclosure Flaw

CVE-2025-36106 Overview

IBM Cognos Analytics Mobile (iOS) versions 1.1.0 through 1.1.22 contains an insecure communication vulnerability stemming from the use of a deprecated or misconfigured AFNetworking library. This weakness could allow malicious actors to intercept, view, and modify data transmitted between the mobile application and backend services. Exploitation of this vulnerability could lead to unauthorized access to confidential information stored on the device or accessible via the network.

Critical Impact

Attackers can perform man-in-the-middle attacks to intercept and modify sensitive business intelligence data transmitted by IBM Cognos Analytics Mobile, potentially compromising confidential organizational information and enabling further network intrusion.

Affected Products

• IBM Cognos Analytics Mobile (iOS) versions 1.1.0 through 1.1.22
• Applications utilizing the vulnerable AFNetworking library configuration
• iOS devices running the affected Cognos Analytics Mobile app

Discovery Timeline

• 2025-07-21 - CVE-2025-36106 published to NVD
• 2025-08-07 - Last updated in NVD database

Technical Details for CVE-2025-36106

Vulnerability Analysis

This vulnerability is classified under CWE-326 (Inadequate Encryption Strength), indicating that the application employs cryptographic protections that are insufficient to properly safeguard sensitive data in transit. The AFNetworking library, a popular networking framework for iOS applications, can be configured in ways that inadvertently weaken or disable proper SSL/TLS certificate validation.

When the AFNetworking library is misconfigured or uses deprecated security settings, the application may accept invalid, self-signed, or malicious certificates without proper verification. This creates an opportunity for attackers positioned on the same network to intercept communications, leading to potential data exfiltration and manipulation of business intelligence data.

Root Cause

The root cause of this vulnerability lies in the improper configuration or use of deprecated features within the AFNetworking library. Specifically, older versions of AFNetworking or misconfigured security policies may disable SSL certificate pinning or accept any SSL certificate without validation. This allows attackers to present fraudulent certificates during the TLS handshake process, effectively bypassing the encryption intended to protect data in transit.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker positioned on the same network as the victim (such as a compromised Wi-Fi network, corporate network, or through ARP spoofing) can perform a man-in-the-middle (MITM) attack. The attack flow typically involves:

1. The attacker positions themselves between the iOS device and the server
2. When the Cognos Analytics Mobile app initiates a connection, the attacker intercepts the TLS handshake
3. Due to the misconfigured AFNetworking library, the app accepts the attacker's fraudulent certificate
4. All subsequent data transmitted between the app and server passes through the attacker's system
5. The attacker can view, log, and modify sensitive business intelligence data in real-time

Since no authentication is required and no user interaction is needed, this vulnerability can be exploited silently against any user of the affected application on a compromised network.

Detection Methods for CVE-2025-36106

Indicators of Compromise

• Unexpected certificate warnings or errors appearing in application logs related to SSL/TLS connections
• Network traffic from the Cognos Analytics Mobile app being routed through unexpected intermediary systems
• Anomalous data access patterns or unauthorized data modifications in Cognos Analytics backend systems
• Detection of ARP spoofing or DNS poisoning attempts targeting mobile devices on the network

Detection Strategies

• Implement network monitoring to detect potential MITM attack indicators such as ARP cache poisoning or DNS spoofing
• Monitor SSL/TLS handshake anomalies using network security tools that can identify certificate mismatches
• Review application logs for certificate validation failures or warnings from the AFNetworking library
• Deploy endpoint detection solutions capable of identifying suspicious network behavior on iOS devices

Monitoring Recommendations

• Enable verbose logging for network connections in enterprise mobile device management (MDM) solutions
• Configure network intrusion detection systems (NIDS) to alert on suspicious SSL/TLS negotiation patterns
• Implement certificate transparency monitoring to detect unauthorized certificates being used
• Regularly audit network traffic flows from mobile devices to identify potential interception points

How to Mitigate CVE-2025-36106

Immediate Actions Required

• Update IBM Cognos Analytics Mobile (iOS) to a version newer than 1.1.22 that addresses this vulnerability
• Advise users to avoid using the application on untrusted networks (public Wi-Fi, shared networks) until patched
• Implement VPN requirements for all mobile application traffic to add an additional layer of encryption
• Review and audit any sensitive data that may have been accessed through the vulnerable application

Patch Information

IBM has released a security advisory addressing this vulnerability. Organizations should consult the IBM Support Page for official patch information and updated application versions. It is strongly recommended to upgrade to the latest version of IBM Cognos Analytics Mobile (iOS) that includes a properly configured AFNetworking library with correct SSL/TLS certificate validation.

Workarounds

• Restrict usage of IBM Cognos Analytics Mobile to trusted, secured network environments only
• Implement enterprise VPN solutions that encrypt all mobile traffic before it reaches the application layer
• Consider deploying mobile threat defense (MTD) solutions that can detect and block MITM attacks in real-time
• Temporarily disable access to sensitive data through the mobile application until the patch is applied

Organizations unable to immediately apply patches should implement strict network access controls and educate users about the risks of using the application on potentially compromised networks.