Description
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.
Published: 2026-10-19
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

This vulnerability enables an authenticated user to cause a denial of service by sending specially crafted SMTP requests that exhaust system resources. The flaw is classified as CWE-770, indicating a lack of proper resource limit enforcement. A successful exploit can lead to uncontrolled CPU and memory consumption, rendering the TS4500 tape library unavailable for legitimate operations.

Affected Systems

IBM Storage TS4500 Library firmware versions 1.1.1.6 through 1.12.0.3, which includes the IBM Diamondback Tape Library, are affected. The vulnerability also applies to any instances running the aforementioned firmware ranges within the IBM Storage TS4500 Library lineup.

Risk and Exploitability

The CVSS score of 6.5 reflects a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog. The exploit requires authenticated access to the device's SMTP interface, implying that attackers must possess valid credentials or compromise a trusted account. Once authenticated, an attacker can send crafted requests to trigger the denial of service.

Generated by OpenCVE AI on October 20, 2026 at 06:05 UTC.

Remediation

Vendor Solution

For the 1.12.0 release, upgrade to firmware version 1.12.0.4 Fix Pack or later, available from IBM Fix Central http://www-933.ibm.com/support/fixcentral/ http://www-933.ibm.com/support/fixcentral/ .  All future releases will include the fix for this vulnerability.

OpenCVE Recommended Actions

  • Upgrade to IBM Storage TS4500 Library firmware 1.12.0.4 or later to apply the fix
  • Restrict SMTP access to legitimate users and isolate the device from public networks
  • Implement monitoring for high CPU and memory usage to detect potential DoS attempts

Generated by OpenCVE AI on October 20, 2026 at 06:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources.
Title TS4500 Tape Library Denial of Service
First Time appeared Ibm
Ibm storage Ts4500 Library
Weaknesses CWE-770
CPEs cpe:2.3:h:ibm:storage_ts4500_library:*:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm storage Ts4500 Library
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Ibm Storage Ts4500 Library
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-20T14:41:22.294Z

Reserved: 2025-04-15T21:16:12.197Z

Link: CVE-2025-36061

cve-icon Vulnrichment

Updated: 2026-10-20T14:41:15.781Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T23:17:35.097

Modified: 2026-10-28T14:10:00.220

Link: CVE-2025-36061

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:15:10Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling