A flaw in the IBM Storage TS4500 Library firmware allows a remote authenticated user to bypass the intended authorization checks and gain control of an account. The vulnerability can be exploited by providing valid credentials to the system and then taking over the account, potentially leading to full system compromise. The weakness is classified as improper authorization, allowing an attacker to gain privileges they are not entitled to.

IBM Storage TS4500 Library firmware versions 1.1.1.6 through 1.12.0.3 are affected. Any appliance running these firmware releases is susceptible to the account takeover flaw before the patch is applied.

The CVSS score of 8.1 indicates a high severity risk, and the EPSS score is not available, so the precise likelihood of exploitation is unknown. The flaw requires remote access and the presence of valid user credentials. Once authenticated, an attacker can take over the account due to the missing authorization enforcement, potentially leading to full control over the device. The vulnerability is not listed in CISA’s KEV catalog, but the lack of listing does not diminish its impact for affected systems.