Description
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.
Published: 2026-10-19
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Authenticated session leading to privilege escalation
Action: Patch
AI Analysis

Impact

The vulnerability exists in IBM Storage TS4500 Library firmware 1.1.1.6 through 1.12.0.3 where the system fails to invalidate a user session after logout or timeout. This flaw permits an authenticated user to continue or restart another user's session, effectively impersonating that user and gaining unauthorized access to library resources. The weakness is an authentication bypass and session management failure.

Affected Systems

IBM Storage TS4500 Library and the Diamondback Tape Library running firmware versions 1.1.1.6 up to 1.12.0.3 inclusive. IBM recommends upgrading to firmware 1.12.0.4 Fix Pack or any later release; all future releases contain the fix.

Risk and Exploitability

The CVSS score of 6.3 reflects moderate severity. No EPSS data has been reported and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploits. The flaw requires a legitimate authenticated account, so attackers must already have access to the system. The likely attack path involves a compromised or otherwise legitimate account exploiting the lack of session invalidation to impersonate another user.

Generated by OpenCVE AI on October 20, 2026 at 06:07 UTC.

Remediation

Vendor Solution

For the 1.12.0 release, upgrade to firmware version 1.12.0.4 Fix Pack or later, available from IBM Fix Central http://www-933.ibm.com/support/fixcentral/ http://www-933.ibm.com/support/fixcentral/ .  All future releases will include the fix for this vulnerability.

OpenCVE Recommended Actions

  • Apply the firmware upgrade to version 1.12.0.4 or a later release to eliminate the session invalidation flaw.
  • Enforce strong authentication and role‑based access controls so that only authorized personnel can log in to the tape library.
  • Configure the library’s session timeout policy to terminate idle sessions quickly and reduce the window for potential impersonation.

Generated by OpenCVE AI on October 20, 2026 at 06:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 23:00:00 +0000

Type Values Removed Values Added
Description IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM TS4500 Tape Library/Diamondback Tape Library does not invalidate session which could allow an authenticated user to impersonate another user on the system.
Title TS4500 Tape Library Insufficient Session Expiration
First Time appeared Ibm
Ibm storage Ts4500 Library
Weaknesses CWE-613
CPEs cpe:2.3:h:ibm:storage_ts4500_library:*:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm storage Ts4500 Library
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L'}

Subscriptions

Ibm Storage Ts4500 Library
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-22T21:15:40.159Z

Reserved: 2025-04-15T21:16:44.887Z

Link: CVE-2025-36252

cve-icon Vulnrichment

Updated: 2026-10-22T21:15:36.236Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T23:17:35.660

Modified: 2026-10-28T14:10:00.220

Link: CVE-2025-36252

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T06:15:10Z

Weaknesses
  • CWE-613

    Insufficient Session Expiration