EUVD-2026-62423
GHSA-hvmr-4fv5-38xw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Network-exposed registration service with no auth (PR:N, AV:N); path traversal write is straightforward (AC:L); no confidentiality loss, but arbitrary file overwrite yields High integrity and Low availability impact.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.
AnalysisAI
Unauthenticated remote file overwrite in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is possible via the nimesis registration service, which fails to sanitize path traversal sequences in client-supplied input. An attacker with network access to the nimesis service can write arbitrary content to locations outside the intended directory, potentially overwriting sensitive system files such as cron jobs, init scripts, or authentication databases. No public exploit or active exploitation has been identified at time of analysis, though the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates this is straightforwardly exploitable without authentication.
Technical ContextAI
The nimesis service is a component of IBM AIX's NIM (Network Installation Management) subsystem, which facilitates network-based provisioning and client registration across IBM Power environments. The CWE-22 (Path Traversal) root cause indicates that the service accepts file path arguments from remote clients and writes to those paths without adequately normalizing or restricting traversal sequences such as '../'. CPE data (cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:*) confirms the flaw spans the full version ranges of IBM AIX and PowerVM VIOS 4.1, as enumerated by NVD. The CVSS impact subscore reflects no confidentiality loss but High integrity impact, consistent with an arbitrary-write primitive where content and path are attacker-controlled.
RemediationAI
IBM has released a patch, available through the vendor advisory at https://www.ibm.com/support/pages/node/7283858. Administrators should apply the fix immediately following IBM's guidance; an exact patched version number was not specified in the data available at time of analysis and must be confirmed from the advisory. As a compensating control prior to patching, restrict network access to the nimesis registration service using host-based firewall rules (e.g., AIX IPFilter or iptables on VIOS) to allow only trusted NIM master hosts to reach the nimesis port - this eliminates remote unauthenticated reach while preserving legitimate NIM functionality. If NIM client registration is not actively in use, consider disabling the nimesis service via SRC (System Resource Controller) with 'stopsrc -s nimesis'; note this will disrupt NIM-based provisioning workflows.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today