CVE-2025-14988
Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
02 Description
Incorrect Permission Assignment for Critical Resource vulnerability in iba Systems ibaPDA
03 Exploitation and scoring
- Exploitation
- Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
- SSVC decision
- ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
- AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
- Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.
- EPSS probability
- 0.44% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 38.4% of scored records. A rank, not a probability.
- NVD base score
- 10.0 (CVSS v4.0), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- NVD analysis status
- Deferred. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-01-27 20:08Z9 MO AGO
- Last updated
- 2026-01-27 20:51Z9 MO AGO
- Reserved
- 2025-12-19
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 10.0)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weaknesses
- CWE-732Incorrect Permission Assignment for Critical ResourceClass
- Data version
- 5.2
- Document digest
- fea7e9d422da59f6c081db9ca421a6288dfec2b35f3342904e554988cad7b5b9
05 Affected products
06 References
07 Remediation
iba Systems recommends users update to ibaPDA v8.12.1 or a later version. If Installing the update is not possible, iba Systems recommends users: * Enable User Management: To activate user management, navigate to User Management settings under the Configure option. Set a password for the admin user to enable user management. Configure Server Access: To configure, open Server Access Manager (found under Configure in the ibaPDA Client). Set the configuration to restrict access. For example, only 127.0.0.1 (localhost) or specific system IP addresses to communicate with ibaPDA can connect to the ibaPDA Server. (In this example, only connections from localhost are permitted to access ibaPDA.) Restrict Connections to Localhost (if ibaPDA is only accessed from the system where it runs): * Go to I/O Manager, then General, and deactivate the option “Automatically open necessary ports in Windows Firewall.” (If this option remains active, after a restart of ibaPDA or a restart for data acquisition, the firewall will be reconfigured automatically.) * Then, go to Advanced Windows Firewall settings and delete or deactivate all incoming rules for the ibaPDA Client and Server. * Manually create firewall rules for the connection used for ibaPDA and verify that the correct ports are configured. For assistance with identifying the ports used by the ibaPDA service can be found in the iba Help Center. * Note: After making the changes, verify that all ibaPDA services are operating as expected