EUVD-2026-62742
GHSA-77f7-4rr4-gqj6
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
DHCP is an adjacent-network, unauthenticated protocol; shell metacharacter injection via options yields full system impact with no user interaction.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options.
AnalysisAI
Arbitrary command execution against IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 is possible by an unauthenticated attacker on the same network segment who can deliver DHCP option values containing unescaped shell metacharacters to the system's DHCP client. The DHCP client fails to neutralize these metacharacters before passing option data to shell processing (CWE-78), enabling full confidentiality, integrity, and availability compromise of the target host. A vendor patch is available via IBM support, and no public exploit or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the DHCP client implementation within IBM AIX - IBM's enterprise proprietary Unix operating system - running versions 7.2 and 7.3, and within IBM PowerVM VIOS 4.1, the Virtual I/O Server component of IBM's PowerVM hypervisor platform. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS Command Injection): DHCP option values supplied by the network are processed without adequate sanitization of shell metacharacters such as semicolons, backticks, pipes, or dollar-sign subshells before being evaluated by a shell interpreter on the host. CPE identifiers cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* reflect broad scope across these product lines. The adjacent-network attack vector (AV:A) directly reflects the Layer 2 broadcast domain constraint of DHCP: an attacker must be able to serve or spoof DHCP responses within the same VLAN or physical network segment as the target, making the exploitability tightly bound to network position.
RemediationAI
The primary remediation is applying the vendor-released patch documented in the IBM support advisory at https://www.ibm.com/support/pages/node/7283858; administrators should identify the appropriate fix pack or interim fix for their specific AIX 7.2, AIX 7.3, or PowerVM VIOS 4.1 maintenance level and apply it promptly. Exact patched version numbers are not enumerated in the available data and must be obtained directly from the advisory. Where immediate patching is not operationally feasible, the most effective compensating control is enabling DHCP snooping on all managed switches in segments hosting AIX or VIOS systems, which prevents rogue DHCP servers from delivering malicious option values - though this requires managed switch infrastructure and introduces configuration management overhead. Deploying 802.1X port-based network access control further restricts unauthorized devices from joining network segments where AIX systems reside. On critical systems where operational requirements permit, configuring static IP addresses and disabling DHCP client functionality eliminates the attack surface entirely, at the cost of increased manual address management. Standard IP-layer ACLs and firewalls are insufficient mitigations because DHCP operates at Layer 2 and rogue responses within the same VLAN are not intercepted by IP-level controls.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today