InfoSecBulletin Cybersecurity for mankind
A critical permission misconfiguration in the IBM QRadar Security Information and Event Management (SIEM) platform could allow local privileged users to manipulate configuration files without authorization.
The flaw, identified as CVE-2025-0164, results from incorrect permission assignments and has a CVSS 3.1 score of 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
Shinyhunters claimed and set deadline to publish E&Y data
Microsoft, NVIDIA and CrowdStrike Initiate Alliance for Open-Source AI Security
Google Search Results Reportedly Show Claude AI Shared Chats
Incorrect Permission Assignment Flaw:
The vulnerability exists due to incorrect permission settings for crucial resources (CWE-732), which does not apply proper access controls on configuration files in QRadar SIEM versions 7.5 to 7.5.0 UP13 IF01.
A local user with high-level privileges can misuse poor file system permissions to change important settings, alter logging policies, or turn off detection rules.
Unauthorized changes may continue until manually fixed, complicating incident response and hiding malicious activities in logs, which could permit further undetected actions.
Mitigations:
IBM has released QRadar 7.5.0 UP13 IF02 to fix CVE-2025-0164, ensuring file and directory permissions only allow write access for the QRadar service account.
Administrators should apply the interim fix immediately on affected systems by downloading the update from IBM Fix Central.
