---
id: CVE-2025-36137
title: >-
  IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0
  through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly
  assigns permissions for maintenance tasks to Control Center Director (CCD)
  users that …
summary: >-
  IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0
  through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly
  assigns permissions for maintenance tasks to Control Center Director (CCD)
  users that …
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-250
vendor: ibm
product: 'sterling_connect:direct'
affected:
  - 'sterling_connect:direct >= 6.2.0.7, < 6.2.0.9'
  - 'sterling_connect:direct >= 6.3.0.2, < 6.3.0.5'
  - 'sterling_connect:direct >= 6.4.0.0, < 6.4.0.2'
  - 'sterling_connect:direct = 6.2.0.9'
  - 'sterling_connect:direct = 6.3.0.5'
  - 'sterling_connect:direct = 6.4.0.2'
patched:
  - 'sterling_connect:direct 6.4.0.2'
published: '2025-10-30'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T21:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-36137'
references:
  - url: 'https://www.ibm.com/support/pages/node/7249678'
    label: psirt@us.ibm.com
tags:
  - nvd
epss: 0.00354
epssPercentile: 0.26947
ingestedAt: '2026-10-07T21:54:14.900Z'
---

## Overview

IBM Sterling Connect Direct for Unix 6.2.0.7 through 6.2.0.9 iFix004, 6.4.0.0 through 6.4.0.2 iFix001, and 6.3.0.2 through 6.3.0.5 iFix002 incorrectly assigns permissions for maintenance tasks to Control Center Director (CCD) users that could allow a privileged user to escalate their privileges further due to unnecessary privilege assignment for post update scripts.

## Affected

- `sterling_connect:direct >= 6.2.0.7, < 6.2.0.9`
- `sterling_connect:direct >= 6.3.0.2, < 6.3.0.5`
- `sterling_connect:direct >= 6.4.0.0, < 6.4.0.2`
- `sterling_connect:direct = 6.2.0.9`
- `sterling_connect:direct = 6.3.0.5`
- `sterling_connect:direct = 6.4.0.2`

## Remediation

Upgrade past the affected range:

- `sterling_connect:direct 6.4.0.2`