CVE-2025-3473: 
IBM Guardium Appliance vulnerability analysis and mitigation

CVE-2025-3473 is a privilege escalation vulnerability in IBM Security Guardium caused by insecure inherited permissions created by the program. It affects IBM Guardium Data Protection versions 11.5 and 12.1, allowing a local privileged user to escalate their privileges to root. The vulnerability was published on June 11, 2025, and assigned a CVSS v3.1 base score of 6.7 (Medium) (IBM Advisory, Red Hat CVE).

The root cause is classified as CWE-277 (Insecure Inherited Permissions), where the IBM Security Guardium program creates files or directories with permissions that are inherited insecurely, enabling privilege escalation. The attack vector is local, requiring an authenticated user with existing elevated (but non-root) privileges to exploit the misconfigured permission inheritance. No user interaction is required, and attack complexity is low, meaning a privileged local user can reliably exploit this condition to gain root-level access (IBM Advisory, Red Hat CVE).

Successful exploitation allows a local privileged user to fully escalate to root on the affected IBM Security Guardium system, resulting in high confidentiality, integrity, and availability impact. An attacker achieving root access could access, modify, or delete sensitive security and audit data managed by Guardium, disable security monitoring functions, and potentially use the compromised host as a pivot point for further attacks within the environment (IBM Advisory).

IBM has released a patch addressing this vulnerability for affected versions of Guardium Data Protection (11.5 and 12.1). Organizations should apply the available fix referenced in IBM's support advisory immediately. As interim measures, administrators should enforce strict access controls on privileged accounts, audit and limit administrative access to Guardium systems, and monitor local user activity for anomalous privilege use (IBM Advisory).