InfoSecBulletin Cybersecurity for mankind
A critical permission misconfiguration in the IBM QRadar Security Information and Event Management (SIEM) platform could allow local privileged users to manipulate configuration files without authorization.
The flaw, identified as CVE-2025-0164, results from incorrect permission assignments and has a CVSS 3.1 score of 2.3 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N).
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Incorrect Permission Assignment Flaw:
The vulnerability exists due to incorrect permission settings for crucial resources (CWE-732), which does not apply proper access controls on configuration files in QRadar SIEM versions 7.5 to 7.5.0 UP13 IF01.
A local user with high-level privileges can misuse poor file system permissions to change important settings, alter logging policies, or turn off detection rules.
Unauthorized changes may continue until manually fixed, complicating incident response and hiding malicious activities in logs, which could permit further undetected actions.
Mitigations:
IBM has released QRadar 7.5.0 UP13 IF02 to fix CVE-2025-0164, ensuring file and directory permissions only allow write access for the QRadar service account.
Administrators should apply the interim fix immediately on affected systems by downloading the update from IBM Fix Central.
