CVE-2025-36421 Overview
CVE-2025-36421 affects IBM Controller versions 11.0.0 through 11.0.1 FP7 and 11.1.0 through 11.1.3 FP1. The application transmits data in clear text, exposing sensitive information to attackers positioned between the client and server. An attacker performing a man-in-the-middle (MITM) attack on the network path can intercept, read, and potentially manipulate traffic between the Controller client and its backend components. The vulnerability is tracked under CWE-319: Cleartext Transmission of Sensitive Information.
Critical Impact
Attackers with network access between Controller components can capture credentials, financial data, and session material transmitted in cleartext.
Affected Products
- IBM Controller 11.0.0 through 11.0.1 FP7
- IBM Controller 11.1.0 through 11.1.3 FP1
- Deployments where Controller traffic traverses untrusted network segments
Discovery Timeline
- 2026-09-18 - CVE-2025-36421 published to NVD
- 2026-09-19 - Last updated in NVD database
Technical Details for CVE-2025-36421
Vulnerability Analysis
IBM Controller is a financial consolidation and reporting application used to close books and prepare regulated financial statements. The affected versions transmit data over the network without enforcing transport-layer encryption. Any sensitive material sent across the wire, including authentication artifacts and financial records, is exposed to observers on the same network path.
The weakness maps to CWE-319, which describes software that sends security-relevant data in cleartext over a communication channel that can be sniffed by unauthorized actors. Because IBM Controller commonly handles account credentials, consolidated financial figures, and pre-release earnings data, the confidentiality impact of interception is meaningful.
Exploitation requires the attacker to occupy a privileged network position. Access to a mirrored switch port, a compromised router, an ARP-spoofed LAN segment, or a rogue Wi-Fi access point is sufficient to observe or modify the traffic.
Root Cause
The root cause is the absence, or inconsistent enforcement, of encrypted transport between Controller components. When TLS is not required or is negotiated weakly, sensitive fields travel as plaintext inside application-layer messages, making passive capture trivial for an on-path adversary.
Attack Vector
The attack vector is network-based and does not require authentication or user interaction. An adversary intercepts traffic between the Controller client, application server, or database tier. Captured cleartext can be replayed, harvested for credentials, or altered before forwarding, enabling downstream account compromise or data tampering.
No public exploit or proof-of-concept is currently listed for this issue. Refer to the IBM Support Page for vendor technical details.
Detection Methods for CVE-2025-36421
Indicators of Compromise
- Unexpected plaintext Controller protocol traffic captured on network taps or SPAN ports.
- ARP table anomalies, duplicate MAC addresses, or gateway MAC changes on subnets carrying Controller traffic.
- New or unauthorized listeners proxying Controller ports between clients and servers.
Detection Strategies
- Inspect flow records and packet captures for Controller sessions negotiating cleartext or downgraded TLS.
- Correlate authentication anomalies in Controller and connected identity providers with periods of suspected MITM activity.
- Baseline expected client-to-server paths and alert on route changes, unexpected proxies, or new intermediate hops.
Monitoring Recommendations
- Enable network detection tooling on segments hosting Controller clients, application servers, and database backends.
- Log and alert on ARP spoofing, DHCP anomalies, and rogue access points near end-user Controller workstations.
- Monitor certificate presentation on Controller endpoints for unexpected issuers or self-signed certificates indicating interception.
How to Mitigate CVE-2025-36421
Immediate Actions Required
- Apply the fixed IBM Controller release documented on the IBM Support Page.
- Restrict Controller traffic to trusted, segmented networks until patching is complete.
- Rotate credentials and session material that may have traversed unencrypted channels.
Patch Information
IBM has published remediation guidance for CVE-2025-36421 on the vendor advisory. Administrators should upgrade IBM Controller beyond 11.0.1 FP7 and 11.1.3 FP1 as specified in the IBM Support Page, then validate that all client and server components negotiate encrypted transport.
Workarounds
- Tunnel Controller traffic through IPsec or a mutually authenticated VPN between clients and application servers.
- Enforce TLS termination at a hardened reverse proxy and disable cleartext listeners at the operating system firewall.
- Isolate Controller components on a dedicated VLAN with strict access control lists limiting who can reach the traffic path.
# Example: block cleartext Controller ports at the host firewall (Linux)
# Adjust <controller_port> to the plaintext port disabled after enforcing TLS
sudo iptables -A INPUT -p tcp --dport <controller_port> -j DROP
sudo iptables -A OUTPUT -p tcp --dport <controller_port> -j DROP
sudo iptables-save | sudo tee /etc/iptables/rules.v4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
