IBM QRadar SIEM Vulnerability Allows Unauthorized Actions by Attackers

A permissions issue in IBM QRadar SIEM could enable local privileged users to modify configuration files without proper authorisation. Tracked as CVE-2025-0164, the flaw stems from incorrect permission assignment for a critical resource, potentially compromising the integrity of a deployed security monitoring environment, and IBM has released an interim fix for QRadar SIEM version 7.5.0 Update 13; administrators are urged to apply Update 02 promptly to correct the file permission settings.

The vulnerability does not allow direct remote exploitation, but attackers with local privileged access could misuse the gap to alter logging parameters, disable specific detection rules, or inject malicious parameters that evade standard security controls.

According to IBM, the issue requires a user with high privileges already on the system, and best practice recommendations include applying the official fix, subscribing to security bulletins, and conducting regular audits and file integrity monitoring to detect unauthorized changes.