EUVD-2026-98179
GHSA-q83c-9gx5-f3gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryAccess BOOTP table management interface
-
ExploitExploit improper authorization check
-
ExecutionModify BOOTP table entries
-
ImpactTamper with device boot parameters
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an interactive or authenticated local presence on the affected IBM i host (AV:L) with at least low-level user privileges (PR:L) - it cannot be performed by a remote or fully unauthenticated attacker. The specific prerequisite is the ability to reach the BOOTP table/configuration function on IBM i 7.3, 7.4, 7.5, or 7.6, where the improper authorization check (CWE-269) fails to prevent a user who lacks the proper authority from modifying BOOTP entries. Limiting factors that reduce real-world risk: the attacker must already hold a valid local account, the impact is confined to Low confidentiality and Low integrity with no availability effect, and systems with few or tightly controlled local user accounts have a correspondingly small exposure surface. |
| Impact | This is a genuinely low-to-moderate priority issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, base 4.4 Medium) requires local access and existing low-level privileges on the IBM i host, limiting the attacker pool to users who already have a valid account on the system. The weakness (CWE-269, improper authorization) lets such a user modify the BOOTP table that they should not be authorized to change, yielding only Low confidentiality and Low integrity impact and no availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; per the precision rules this means there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - a low-complexity but privilege- and local-access-gated authorization flaw - so there is no CVSS-versus-reality conflict to flag; the main caveat is simply that exploitation-probability (EPSS) and exploitation-status (KEV/POC) telemetry are absent, so risk is assessed from the CVSS vector and description alone. Real priority is modest: patch in normal maintenance cycles unless the host has many low-privilege or untrusted local accounts. |
| Exploit ScenarioDerived | A low-privileged but authenticated local user on an IBM i 7.3-7.6 system abuses the improper authorization check to alter entries in the BOOTP table, which they are not supposed to be able to modify. By changing boot parameters they could redirect or tamper with network boot/provisioning of client devices served by that BOOTP configuration. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local users on IBM i 7.3, 7.4, 7.5, and 7.6 can modify the system BOOTP table because the operating system fails to enforce a proper authority check on that configuration function, a case of improper privilege management (CWE-269). Exploitation requires an interactive or authenticated local presence on the host with at least low-level privileges (CVSS vector AV:L/PR:L), so neither a remote nor a fully unauthenticated attacker can trigger it, and the resulting impact is capped at low confidentiality and low integrity with no availability effect (CVSS 4.4). No public exploit code has been identified at time of analysis and there is no evidence of active exploitation, though IBM has published a vendor fix; this is a low-to-moderate priority issue rather than a top-tier emergency, with exposure scaling with the number of local accounts permitted on the partition.
RemediationAI
Apply the vendor-released fix documented in IBM's advisory for CVE-2026-18343 at https://www.ibm.com/support/pages/node/7290194 - because IBM i patches ship as PTFs and group PTFs, the specific PTF numbers and target level for each of 7.3, 7.4, 7.5, and 7.6 must be read from that page rather than assumed (patch status: patch available per vendor advisory; no exact fix version is published in the intelligence feed). Where immediate patching is not possible, compensating controls include auditing and tightly restricting which profiles hold *IOSYSCFG or equivalent TCP/IP configuration authority, since the flaw is an authorization enforcement gap that only matters for users who can reach the BOOTP configuration path; the trade-off is that legitimate network administrators may need temporary elevated authority to manage BOOTP entries. Additionally, inventory and baseline the current BOOTP table contents and alert on any change to it, and reduce the number of unprivileged interactive local accounts and their access to system configuration menus, accepting that this limits usability for operators. Because exploitation demands an existing local account and yields only low confidentiality and low integrity impact, remediation can be scheduled as routine maintenance rather than emergency change - this is a genuinely low-to-moderate priority issue, not a top-tier emergency - but it should not be left indefinitely unaddressed on partitions with many local users.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the BOOTP (Bootstrap Protocol) table on IBM i, a network-boot configuration structure the system uses to hand out boot parameters - IP assignment, boot server, and boot file references - to BOOTP clients. Normally, altering such TCP/IP configuration on IBM i requires elevated special authority (typically *IOSYSCFG). CWE-269 (Improper Privilege Management) indicates the root cause is that the authorization check protecting the BOOTP table is insufficient: a user who should not hold the required authority can still write to or change entries. The relevant CPE, cpe:2.3:a:ibm:i:*:*:*:*:*:*:*:*, confirms the product is IBM i generally without pinning to a service level, and the vendor description explicitly enumerates releases 7.3, 7.4, 7.5, and 7.6. The security consequence of a tampered BOOTP table is an integrity problem on the boot/network-provisioning path - clients could be pointed at attacker-chosen boot data - with a modest confidentiality spillover; there is no denial-of-service or availability component in the assessed vector.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Local authenticated user abuses a missing authorization check, so AV:L and PR:L; low-complexity modification of a config table gives I:L and incidental C:L, no availability loss.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB