I Access Client Solutions
CVE-2023-45182
MEDIUM
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265.
AnalysisAI
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-922. IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. By somehow gaining access to the encrypted password, a local attacker could exploit this vulnerability to obtain the password to other systems. IBM X-Force ID: 268265. Affected products include: Ibm I Access Client Solutions. Version information: through 1.1.4.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in I Access Client Solutions
View allCode-integrity failure in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 lets a positioned attack
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTL
Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker t
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote
OS command injection in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 enables a local attacker to exec
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly w
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryp
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execut
Same weakness CWE-922 – Insecure Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today