CVE-2025-2141 Details
Description
IBM System Storage Virtualization Engine TS7700 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
A cross-site scripting vulnerability has been identified in IBM System Storage Virtualization Engine TS7700, specifically in the 3957 VED R5.4 8.54.2.17, R6.0 8.60.0.115, 3948 VED R5.4 8.54.2.17, R6.0 8.60.0.115, and 3948 VEF R6.0 8.60.0.115 versions. This vulnerability allows an authenticated user to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to credential disclosure within a trusted session.
Users are advised to upgrade to the latest microcode version. For 3957 VED and 3948 VED, upgrade to 8.54.2.17 or 8.54.1.27, and for 3948 VEF, upgrade to 8.60.0.115. After upgrading, install the appropriate VTD_EXEC package. Minimum VTD_EXEC versions required are VTD_EXEC.904 for 3957 and 3948 VED, and VTD_EXEC.905 for 3948 VEF.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.ibm.com/support/pages/node/7238556 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ibm 3948-vef firmware | <= 8.60.0.115 |
CPE
Remediation
| |
| ibm 3948-vef | All versions |
CPE
Remediation
| |
| ibm 3948-ved firmware | <= 8.54.2.17 <= 8.60.0.115 |
CPE
Remediation
| |
| ibm 3948-ved | All versions |
CPE
Remediation
| |
| ibm 3957-ved firmware | <= 8.54.2.17 <= 8.60.0.115 |
CPE
Remediation
| |
| ibm 3957-ved | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 30, 2025 | Initial Analysis | [email protected] |
| Jul 1, 2025 | New CVE Received | [email protected] |