InfoSecBulletin Cybersecurity for mankind
A critical permission misconfiguration in the IBM QRadar Security Information and Event Management (SIEM) platform could allow local privileged users to manipulate configuration files without authorization.
The flaw, identified as CVE-2025-0164, results from incorrect permission assignments and has a CVSS 3.1 score of 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Incorrect Permission Assignment Flaw:
The vulnerability exists due to incorrect permission settings for crucial resources (CWE-732), which does not apply proper access controls on configuration files in QRadar SIEM versions 7.5 to 7.5.0 UP13 IF01.
A local user with high-level privileges can misuse poor file system permissions to change important settings, alter logging policies, or turn off detection rules.
Unauthorized changes may continue until manually fixed, complicating incident response and hiding malicious activities in logs, which could permit further undetected actions.
Mitigations:
IBM has released QRadar 7.5.0 UP13 IF02 to fix CVE-2025-0164, ensuring file and directory permissions only allow write access for the QRadar service account.
Administrators should apply the interim fix immediately on affected systems by downloading the update from IBM Fix Central.
