Maximo Ai Service
Monthly
Unauthenticated network requests to IBM Maximo AI Service 9.1.0 and 9.2.0 can exhaust server resources and render the service unavailable, as described by CWE-400 uncontrolled resource consumption. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, but its impact is confined to availability - there is no data disclosure, data modification, or code execution. IBM has published a vendor patch advisory (https://www.ibm.com/support/pages/node/7290473); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is service downtime for internet- or network-exposed deployments rather than a breach.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS allows remote unauthenticated attackers to trigger uncontrolled recursion in an exposed processing path, causing availability impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no privileges or user interaction are required and only availability is affected; no public exploit identified at time of analysis. IBM has released a vendor patch via its support advisory for the identified service levels, and because the product is SaaS, IBM controls the deployed instance and its patching.
Remote code execution in IBM Maximo AI Service 9.1.0 and 9.2.0 lets an unauthenticated remote attacker execute arbitrary code on an affected deployment by abusing improper control of code generation (CWE-94). With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no authentication, no user interaction, and no special conditions beyond network reachability of the vulnerable instance. No public exploit code has been identified at time of analysis, and there is no KEV listing; IBM has published an advisory with a vendor fix, so the practical priority is identifying and patching internet- or network-exposed Maximo AI Service 9.1.0/9.2.0 instances.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 allows unauthenticated remote attackers to terminate the host process by sending malformed frames that the service does not handle correctly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms that no credentials or user interaction are required, so the only practical gating factor is network reachability to the service endpoint; impact is confined to availability with no data disclosure or modification. No public exploit code has been identified at time of analysis, and the vendor has published a patch advisory.
Unauthenticated network requests to IBM Maximo AI Service 9.1.0 and 9.2.0 can exhaust server resources and render the service unavailable, as described by CWE-400 uncontrolled resource consumption. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5), the flaw is network-reachable, low-complexity, and requires no credentials or user interaction, but its impact is confined to availability - there is no data disclosure, data modification, or code execution. IBM has published a vendor patch advisory (https://www.ibm.com/support/pages/node/7290473); no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is service downtime for internet- or network-exposed deployments rather than a breach.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 SaaS allows remote unauthenticated attackers to trigger uncontrolled recursion in an exposed processing path, causing availability impact. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, so no privileges or user interaction are required and only availability is affected; no public exploit identified at time of analysis. IBM has released a vendor patch via its support advisory for the identified service levels, and because the product is SaaS, IBM controls the deployed instance and its patching.
Remote code execution in IBM Maximo AI Service 9.1.0 and 9.2.0 lets an unauthenticated remote attacker execute arbitrary code on an affected deployment by abusing improper control of code generation (CWE-94). With a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires no authentication, no user interaction, and no special conditions beyond network reachability of the vulnerable instance. No public exploit code has been identified at time of analysis, and there is no KEV listing; IBM has published an advisory with a vendor fix, so the practical priority is identifying and patching internet- or network-exposed Maximo AI Service 9.1.0/9.2.0 instances.
Denial of service in IBM Maximo AI Service 9.1.0 and 9.2.0 allows unauthenticated remote attackers to terminate the host process by sending malformed frames that the service does not handle correctly. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms that no credentials or user interaction are required, so the only practical gating factor is network reachability to the service endpoint; impact is confined to availability with no data disclosure or modification. No public exploit code has been identified at time of analysis, and the vendor has published a patch advisory.