CVE-2025-36106

MEDIUM

IBM Cognos Analytics Mobile 1.1.0-1.1.22 - Inadequate Encryption Strength via AFNetworking Library

Title source: llm
STIX 2.1

Description

IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 could allow malicious actors to view and modify information coming to and from the application which could then be used to access confidential information on the device or network by using a the deprecated or misconfigured AFNetworking library at runtime.

References (1)

Core 1
Core References
Vendor Advisory vendor-advisory patch
https://www.ibm.com/support/pages/node/7239635

Scores

CVSS v3 6.5
EPSS 0.0018
EPSS Percentile 7.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-326
Status published
Products (1)
ibm/cognos_analytics_mobile 1.1.0 - 1.1.23
Published Jul 21, 2025
Tracked Since Feb 18, 2026