CVE-2025-36125: IBM Hardware Management Console XSS Flaw

CVE-2025-36125 Overview

IBM Hardware Management Console (HMC) for Power 10 contains a stored cross-site scripting (XSS) vulnerability tracked as CVE-2025-36125. The flaw affects HMC versions 10.3.1050.0 and 11.1.1110.0. An authenticated user can embed arbitrary JavaScript in the Web UI, altering intended functionality within a trusted administrative session.

Successful exploitation may lead to credential disclosure or hijacking of privileged HMC operator sessions. Because HMC manages Power servers, LPAR configuration, and firmware operations, injected scripts execute in a highly privileged administrative context. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Stored JavaScript executes in the browsers of HMC administrators, enabling session credential theft and potential lateral movement into Power server management operations.

Affected Products

IBM Hardware Management Console - Power 10.3.1050.0
IBM Hardware Management Console - Power 11.1.1110.0
Deployments managing IBM Power server infrastructure via the HMC Web UI

Discovery Timeline

2025-09-09 - CVE-2025-36125 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36125

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the HMC Web UI. Persisted user-controlled input is rendered back to administrators without adequate output encoding or sanitization. As a result, JavaScript payloads written by one authenticated user execute in the browser of any subsequent user who views the affected UI element.

Because the attack originates from an authenticated but lower-privileged user and executes in a higher-privileged administrator's session, the security scope changes. This yields impact on the confidentiality and integrity of data accessible to the victim session. The HMC governs LPAR provisioning, firmware updates, and service processor access, so a hijacked session has direct operational reach over Power hardware.

Root Cause

The root cause is missing or insufficient neutralization of HTML and JavaScript control characters in stored input fields rendered by the HMC Web UI. Input persisted through the interface is later reflected without contextual output encoding, allowing <script> tags or event-handler attributes to be interpreted as executable code by the browser.

Attack Vector

Exploitation requires an authenticated user with access to submit content into an affected HMC input field. The attacker embeds a JavaScript payload that is stored server-side. When a targeted administrator loads the page containing the payload, the script executes with that administrator's session context. User interaction is required, consistent with viewing the tainted UI element. No local access or elevated privileges are needed to plant the payload; only Web UI access to an authenticated HMC account.

No public proof-of-concept exploit code is available for CVE-2025-36125. See the IBM Support advisory for vendor technical details.

Detection Methods for CVE-2025-36125

Indicators of Compromise

Unexpected <script>, onerror, onload, or javascript: strings stored in HMC configuration fields, names, or descriptions
HMC Web UI sessions initiating outbound HTTP requests to unknown domains from administrator browsers
Anomalous administrative actions performed shortly after an administrator viewed a user-editable HMC page
Session tokens or authentication cookies appearing in web server or proxy logs originating from HMC UI referers

Detection Strategies

Audit stored HMC objects (partition names, profile descriptions, user-supplied labels) for HTML or JavaScript tokens using inventory queries against the HMC database
Inspect HMC HTTP access logs for POST requests containing encoded script fragments (%3Cscript, javascript%3A, onerror%3D)
Compare rendered HMC page output against expected content baselines to identify injected DOM elements

Monitoring Recommendations

Forward HMC Web UI access and audit logs to a centralized SIEM for retention and correlation
Alert on HMC administrator sessions performing configuration changes immediately following page views of user-editable content
Monitor for new or unusual outbound network connections from HMC administrator workstations during active browser sessions

How to Mitigate CVE-2025-36125

Immediate Actions Required

Apply the IBM-supplied fix referenced in the IBM Support advisory for CVE-2025-36125
Restrict HMC Web UI network access to a dedicated management VLAN reachable only from trusted administrator workstations
Review existing HMC user accounts and remove or downgrade accounts that do not require write access to shared UI fields
Audit stored HMC content for previously injected payloads and sanitize any suspicious entries before patching

Patch Information

IBM has published guidance for HMC versions 10.3.1050.0 and 11.1.1110.0 in the vendor advisory. Refer to the IBM Support Page for the specific fix packages and installation procedure appropriate for each affected HMC release.

Workarounds

Enforce least-privilege role assignments so only trusted operators can write to HMC fields that render in shared views
Require administrators to access the HMC Web UI from hardened, dedicated browsers without stored credentials to unrelated systems
Enable browser-side Content Security Policy enforcement at any reverse proxy fronting the HMC, restricting inline script execution where feasible

bash

# Example: restrict HMC Web UI access at the network layer
# Replace 10.10.20.0/24 with the trusted administrator subnet
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP