I Access Client Solutions
Monthly
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 7.8 High rating reflects the full confidentiality, integrity, and availability impact achievable once a local foothold exists.
Code-integrity failure in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 lets a positioned attacker deliver unverified, compromised product code to a user's workstation when ACS is configured to auto-update from an IBM i host. Because ACS does not validate the integrity/authenticity of downloaded update code (CWE-494), an attacker who can serve or tamper with that update stream can achieve arbitrary code execution on the client machine. Carries a vendor CVSS of 9.6 (adjacent, scope-changed, full CIA impact), but there is no public exploit identified at time of analysis and EPSS is very low at 0.11%.
Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker to write arbitrary files outside the intended extraction directory when a victim imports a maliciously crafted configuration archive. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-deliverable with low complexity but requires the target user to actively import the crafted configuration - a social engineering dependency that is the primary limiting factor. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
OS command injection in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 enables a local attacker to execute arbitrary code on the underlying operating system. Exploitation requires user interaction (UI:R) but no prior privileges (PR:N), suggesting the attack vector involves a maliciously crafted file or input that a victim opens or processes with the client application. IBM has released a patch via advisory node/7282954, and no public exploit or CISA KEV listing has been identified at time of analysis.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking. Rated medium severity (CVSS 6.7). This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.
Arbitrary code execution in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 on Windows is enabled by a publicly writable directory created when the application is installed in 'all users' mode. A local attacker with low privileges can plant malicious content in this directory, which the application subsequently loads with higher-privilege context, achieving full code execution. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.11% (2nd percentile) reflects low observed exploitation pressure, though the SSVC technical impact rating is 'total', underscoring the severity if exploited.
Arbitrary code execution is achievable on Windows endpoints running IBM i Access Client Solutions (ACS) 1.1.2.0 through 1.1.9.13 when the software is installed in all-users mode, because the installer leaves one or more configuration files world-writable. Any local user with standard (non-administrator) privileges can modify these files to inject code that executes under the security context of other users who subsequently launch the application. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the CVSS 7.8 High rating reflects the full confidentiality, integrity, and availability impact achievable once a local foothold exists.
Code-integrity failure in IBM i Access Client Solutions (ACS) versions 1.1.2.0 through 1.1.9.13 lets a positioned attacker deliver unverified, compromised product code to a user's workstation when ACS is configured to auto-update from an IBM i host. Because ACS does not validate the integrity/authenticity of downloaded update code (CWE-494), an attacker who can serve or tamper with that update stream can achieve arbitrary code execution on the client machine. Carries a vendor CVSS of 9.6 (adjacent, scope-changed, full CIA impact), but there is no public exploit identified at time of analysis and EPSS is very low at 0.11%.
Zip slip path traversal in IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 allows a network-positioned attacker to write arbitrary files outside the intended extraction directory when a victim imports a maliciously crafted configuration archive. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-deliverable with low complexity but requires the target user to actively import the crafted configuration - a social engineering dependency that is the primary limiting factor. No public exploit or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
OS command injection in IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 enables a local attacker to execute arbitrary code on the underlying operating system. Exploitation requires user interaction (UI:R) but no prior privileges (PR:N), suggesting the attack vector involves a maliciously crafted file or input that a victim opens or processes with the client application. IBM has released a patch via advisory node/7282954, and no public exploit or CISA KEV listing has been identified at time of analysis.
IBM i Access Client Solutions versions 1.1.2.0 through 1.1.9.13 expose a publicly writable truststore, allowing a local authenticated attacker to inject a rogue certificate authority and subsequently intercept or manipulate TLS-protected communications. The writable truststore breaks the chain of trust at the client level, enabling man-in-the-middle attacks against sessions the client believes are cryptographically secured. No public exploit or active exploitation has been identified at time of analysis, and EPSS probability is extremely low at 0.09%.
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to execute remote code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 is vulnerable to having its key for an encrypted password decoded. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity. No vendor patch available.
IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking. Rated medium severity (CVSS 6.7). This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution.