Listen to this Post
How CVE-2025-36398 Works
CVE-2025-36398 is a vulnerability affecting IBM System Storage DS8A00 and DS8900F storage systems. The flaw resides in how these systems handle user command history files. Specifically, the filename used to store a user’s command history is influenced by external input without proper sanitization. This is classified as CWE-73: External Control of File Name or Path.
An authenticated user can exploit this externally controlled filename to read or modify the command history of another user. The attack works because the system does not properly validate or restrict the path used for the history file, allowing a malicious actor to point the history file to a different user’s history or to manipulate its contents.
The attack requires the attacker to have valid credentials on the system, making it an authenticated vulnerability rather than a remote unauthenticated one. However, once authenticated, the attacker can access sensitive commands that other users have executed, which may contain passwords, IP addresses, system configurations, or other confidential information. Additionally, by modifying another user’s history, the attacker could cover their tracks or tamper with audit trails.
The vulnerability affects DS8A00 firmware versions 10.1.3.0 through 10.11.35.0 and DS8900F firmware versions 89.40.83.0 through 89.44.25.0. IBM has released fixed microcode bundles: DS8A00 bundles 10.11.34.1 or 10.12.39.0, and DS8900F bundles 89.44.17.1, 89.44.25.1, 89.44.26.0, or 89.45.10.0. Some of these fixes are HMC-only updates and do not require a full code installation.
The CVSS base score is 5.4 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. This indicates a medium-severity vulnerability with low impact on confidentiality and integrity, and no impact on availability.
DailyCVE Form:
Platform: IBM DS8A00/DS8900F
Version: 10.1.3.0-10.11.35.0 / 89.40.83.0-89.44.25.0
Vulnerability: External Filename Control
Severity: 5.4 Medium
Date: August 19, 2026
Prediction: Patch available now (bundles 10.11.34.1, 89.44.17.1+)
What Undercode Say:
Check current firmware version on DS8900F dscli -user <username> -pass <password> lsfabric -type model Verify DS8A00 firmware version dscli lssi -l Query affected versions: DS8A00: 10.1.3.0 through 10.11.35.0 DS8900F: 89.40.83.0 through 89.44.25.0 Example command to check command history (vulnerable context) cat ~/.bash_history User's own history Attacker could manipulate filename to access: /home/otheruser/.bash_history Check if HMC-only update is sufficient: DS8A00 10.11.34.0 -> 10.11.34.1 (HMC-only) DS8900F 89.44.17.0 -> 89.44.17.1 (HMC-only) DS8900F 89.44.25.0 -> 89.44.25.1 (HMC-only) Verify microcode bundle version dscli lsversion -l
Exploit: (Educational Purposes!)
STEP 1: Authenticate to the DS8K system (legitimate credentials required) ssh username@ds8k-management-ip STEP 2: Identify the command history file path controlled by external input The vulnerable system uses user-supplied input to determine which history file to access Example: The system might use an environment variable or parameter like: HISTORY_FILE=/home/$USER/.command_history STEP 3: Craft a malicious input to redirect to another user's history Instead of /home/attacker/.command_history, the attacker supplies: ../../otheruser/.command_history STEP 4: Read the target user's command history cat /home/otheruser/.command_history STEP 5: Modify or corrupt the target user's history (tampering/covering tracks) echo "rm -rf /critical/data" >> /home/otheruser/.command_history STEP 6: Alternate vector - if the system uses a parameter like: dscli -history <filename> Attacker calls: dscli -history ../../otheruser/.command_history
Protection:
- Upgrade firmware to DS8A00 bundle 10.11.34.1 (or 10.12.39.0) and DS8900F bundle 89.44.17.1, 89.44.25.1, 89.44.26.0, or 89.45.10.0
- Apply HMC-only updates if currently on 10.11.34.0 (DS8A00) or 89.44.17.0/89.44.25.0 (DS8900F)
- Restrict and audit user access; DS8K supports LDAP, MFA, and audit logging
- Monitor for unauthorized access to command history files
- Implement least privilege principle – limit authenticated users to only necessary functions
Impact:
- Confidentiality – Attacker can read other users’ command history, potentially exposing sensitive commands, credentials, IP addresses, and system configurations
- Integrity – Attacker can modify command history, tampering with audit trails and covering malicious activities
- Authentication Required – Attack requires valid user credentials; not remotely exploitable without prior access
- Medium Severity – CVSS 5.4; limited to multi-user environments with shared access
- No Availability Impact – The vulnerability does not affect system availability
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
