External risk intelligence

IBM AIX and VIOS NIM Server Directory Traversal and Arbitrary File Write Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-36236

The vulnerability affects the Network Installation Management (NIM) server on IBM AIX and VIOS. NIM is a specialized administrative service used for managing operating system installations and updates within internal data center environments. While network-accessible, it is not typically exposed to the public internet and is generally restricted to internal management networks.

Path Traversal

Ibm Vios

3.1.04.1.07.27.3

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in IBM's AIX and VIOS systems, specifically impacting the Network Installation Management (NIM) service. This issue allows an unauthorized remote attacker to potentially gain unauthorized access to system files, which could lead to significant data compromise or system manipulation. The primary concern at this time is to confirm whether these specific IBM services are in use within our environment.

Attackers can read and write system files remotely.
Affects specialized IBM installation services.
Confirm if these IBM services are in use.

Attack Path

How an attacker could exploit the issue

An attacker could remotely target the IBM NIM server, which manages system installations, by sending a specially crafted web request. This request could trick the server into writing arbitrary files, potentially allowing the attacker to gain control or compromise the system's integrity.

Unauthenticated network access required.
Specially crafted URL request triggers vulnerability.
Arbitrary file write and system compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could exploit this vulnerability to write arbitrary files on the affected system by sending a specially crafted URL request to the NIM server. This directory traversal could impact system integrity and availability.

NIM server files and directories.
Attacker crafts malicious URL requests.
Arbitrary file writes, impacting system operations.

Operational Fix

Recommended remediation, mitigation, and detection steps

The IBM AIX and VIOS NIM server is likely managed by infrastructure or platform teams responsible for operating system deployment and management. Initial triage should focus on identifying all NIM servers, confirming their network exposure, and determining business criticality to prioritize remediation efforts.

Infrastructure or platform teams should own.
Verify NIM server network exposure and criticality.
Plan and coordinate remediation with affected teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the IBM NIM server used for in AIX and VIOS?

The Network Installation Management (NIM) server acts as a centralized administrative hub for managing operating system deployments, software updates, and maintenance tasks across IBM AIX and VIOS environments. It facilitates the automated installation and configuration of systems within a data center, serving as a critical infrastructure component for IT administrators to maintain fleet consistency.

How does CVE-2025-36236 enable directory traversal?

This vulnerability is classified as Improper Limitation of a Pathname to a Restricted Directory (CWE-22). It occurs because the NIM server fails to properly sanitize input from URL requests. By sending a specially crafted request, an attacker can manipulate file paths to escape intended directories and write arbitrary files to unauthorized locations on the underlying host system.

Do I need authentication to trigger this vulnerability?

No, authentication is not required to trigger this bug. The vulnerability exists within the nimesis service, which processes incoming requests. A remote attacker can reach the service over the network and send a crafted URL request to execute the malicious file write action without needing a valid user account or prior access to the NIM environment.

How relevant is this CVE-2025-36236 threat to my network?

According to Halo Surface Signal, this risk is generally localized. While the NIM server is network-accessible, it is designed for internal data center management and is rarely exposed to the public internet. Systems kept within restricted management networks face a lower risk profile compared to those inadvertently reachable from broader or public-facing segments.

When should I begin responding to this vulnerability?

You should start by identifying all active NIM servers within your infrastructure. Coordinate with the platform or infrastructure teams that manage operating system deployments to confirm which systems are running the affected versions of AIX or VIOS. Once inventory is complete, assess their network accessibility and business criticality to prioritize your patching schedule.

References

www.ibm.com/support/pages/node/7251173

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.