The vulnerability is a race condition in IBM Storage TS4500 Library firmware that allows a remote authenticated attacker to gain unauthorized administrative privileges. The race condition exploits timing differences in concurrent operations, mapping to CWE‑362, and can let a malicious user elevate privileges to full control of the library.

The affected product is IBM Storage TS4500 Library. Versions 1.1.1.6 through 1.12.0.3 are vulnerable. Any firmware earlier than 1.12.0.4 is impacted. The fix is available in firmware 1.12.0.4 Fix Pack and later, and all future releases will include the fix.

The CVSS score is 6.8, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The attacker must be remote authenticated and trigger the race condition through repeated concurrent actions, so exploitation depends on the attacker’s ability to access the library. Despite the uncertainty in exploitation probability, the potential to gain full administrative rights is significant, making prompt remediation important.