InfoSecBulletin Cybersecurity for mankind
A critical permission misconfiguration in the IBM QRadar Security Information and Event Management (SIEM) platform could allow local privileged users to manipulate configuration files without authorization.
The flaw, identified as CVE-2025-0164, results from incorrect permission assignments and has a CVSS 3.1 score of 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Incorrect Permission Assignment Flaw:
The vulnerability exists due to incorrect permission settings for crucial resources (CWE-732), which does not apply proper access controls on configuration files in QRadar SIEM versions 7.5 to 7.5.0 UP13 IF01.
A local user with high-level privileges can misuse poor file system permissions to change important settings, alter logging policies, or turn off detection rules.
Unauthorized changes may continue until manually fixed, complicating incident response and hiding malicious activities in logs, which could permit further undetected actions.
Mitigations:
IBM has released QRadar 7.5.0 UP13 IF02 to fix CVE-2025-0164, ensuring file and directory permissions only allow write access for the QRadar service account.
Administrators should apply the interim fix immediately on affected systems by downloading the update from IBM Fix Central.
