SecuriTricks - CVE-2025-36057

Description

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local Authentication Framework library which is not needed as biometric authentication is not used in the application.

Product(s) Impacted

Vendor	Product	Versions
Ibm	Cognos Analytics Mobile	1.1.0-1.1.22

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-299

Improper Check for Certificate Revocation

The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	ibm	cognos_analytics_mobile	1.1.0-1.1.22	/	/	/	/	/	/	/

References

https://www.ibm.com/support/pages/node/7239635

CVSS Score

5.2 / 10

CVSS Data - 3.1

Attack Vector: PHYSICAL
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

View Vector String

Timeline

Published: July 21, 2025, 7:15 p.m.
Last Modified: July 22, 2025, 1:05 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

CVE-2025-36057