← Vulnerability feed

Vulnerability record · CVE-2025-1095 · published 8 April 2025

CVE-2025-1095: Ibm personal communications vulnerability

Ibm · Personal Communications

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.

7.8 CVSS 3.1 High EPSS 0.14% · top 97.0% CWE-420 · CWE-420
7.8CVSS 3.1 base score
0.14%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

IBM Personal Communications v14 and v15 include a Windows service that is vulnerable to local privilege escalation (LPE). The vulnerability allows any interactively logged in users on the target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to escalate their privileges. This vulnerability is due to an incomplete fix for CVE-2024-25029.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.ibm.com/support/pages/node/7230335 Vendor Advisory

Track CVE-2025-1095 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2024-25029Ibm personal communications memory buffer overflow vulnerabilityIBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege es…EPSS 0.79%9.3CVE-2012-0201Ibm personal communications memory buffer overflow vulnerabilityStack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote a…EPSS 37%6.2CVE-2016-0321Ibm personal communications information exposure vulnerabilityIBM Personal Communications (aka PCOMM) 6.x before 6.0.17 and 12.x before 12.0.0.1 does not properly restrict credential extraction, which allows loc…EPSS 0.37%9.8CVE-2025-54309CrushFTP AS2 validation flaw grants remote admin accessCrushFTP 10 before 10.8.5 and 11 before 11.3.4_23 mishandle AS2 validation when the DMZ proxy feature is not in use, letting remote attackers obtain …KEVEPSS 95%analysed10.0CVE-2023-20198Cisco IOS XE Web UI unauthenticated privilege escalation and implant deploymentCVE-2023-20198 is a critical flaw in the Cisco IOS XE web UI that lets an unauthenticated remote attacker gain initial access and create a local priv…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2025-1095), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.