EUVD-2026-62745
GHSA-q2cr-mw65-vf8v
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
RA processing is automatic and unauthenticated at the OS network stack level; AV:A reflects L2-scoped ICMPv6 delivery; RCE with elevated privileges justifies C:H/I:H/A:H.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements.
AnalysisAI
Remote code execution in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 is achievable by an unauthenticated attacker on the same network segment via command injection triggered by crafted IPv6 Router Advertisement messages. The vulnerability (CWE-269, Improper Privilege Management) implies the RA processing subsystem executes injected commands with elevated OS-level privileges, enabling full confidentiality, integrity, and availability compromise of the affected host. No public exploit has been identified at time of analysis; IBM has released a patch per advisory https://www.ibm.com/support/pages/node/7283858.
Technical ContextAI
Router Advertisements (RAs) are ICMPv6 Type 134 messages defined in RFC 4861, broadcast by routers on a local network segment to deliver IPv6 configuration parameters to hosts. IBM AIX is a Unix-derived operating system for IBM POWER architecture hardware; IBM PowerVM VIOS (Virtual I/O Server) is the hypervisor management layer for IBM Power virtualization environments. The RA handling code in both products appears to incorporate attacker-controlled fields from RA messages into OS command construction without adequate sanitization, constituting a command injection flaw. CWE-269 (Improper Privilege Management) indicates the vulnerable process runs with privileges beyond those required - consistent with network stack daemons that typically operate as root or with kernel-adjacent privileges on AIX. Affected CPEs are cpe:2.3:a:ibm:aix:*:*:*:*:*:*:*:* (versions 7.2 and 7.3) and cpe:2.3:a:ibm:powervm_vios:*:*:*:*:*:*:*:* (version 4.1).
RemediationAI
Apply the vendor-released patch documented in the IBM Security Advisory at https://www.ibm.com/support/pages/node/7283858. Administrators should consult that advisory directly to identify the exact patched build level for their AIX version (7.2 or 7.3) and VIOS 4.1 installation, as specific fix-version strings are not enumerated in the available intelligence data. Where immediate patching is not feasible, deploy RA Guard (RFC 6105) on the switching infrastructure serving IBM Power systems to block untrusted Router Advertisement messages at the VLAN boundary - note this must be configured on switches, not hosts, and requires careful testing to avoid disrupting legitimate IPv6 router discovery. Alternatively, configuring IPv6 stateless address autoconfiguration (SLAAC) protection or disabling IPv6 on interfaces that do not require it removes the attack surface entirely at the cost of IPv6-dependent services. Do not rely solely on host-based filtering; RA Guard at the network layer is more effective and harder to bypass.
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
Multiple unspecified vulnerabilities in the InfiniBand subsystem in IBM AIX 6.1 and 7.1, and VIOS 2.2.2.2-FP-26 SP-02, a
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout c
IBM AIX contains an unspecified vulnerability that would allow a locally authenticated user to obtain root level privile
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains an unspecified vulnerability that would allow a locally authenticated user to ob
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to gain root privileges using a specially crafted command within the
lquerylv in cmdlvm in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x allows local users to gain privileges via a crafted DBGCM
libodm.a in IBM AIX 5.3, 6.1, and 7.1 allows local users to overwrite arbitrary files via a symlink attack on a temporar
libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on
OS command injection in IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 lets a remote, low-privileged authenticated attacker ru
OS command injection in IBM AIX 7.2 and 7.3 and in IBM PowerVM VIOS 4.1 lets a remote, authenticated attacker execute ar
OS command injection in IBM AIX 7.2/7.3 and PowerVM VIOS 4.1 lets a remote authenticated attacker run arbitrary commands
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today