## Summary
IBM i Access Client Solutions (1.1.2.0 through 1.1.9.13) is vulnerable to local arbitrary code execution due to improper neutralization of special elements used in an OS command (CWE-78).
## Technical Details
- Root issue class: improper neutralization of special elements used in an OS command (CWE-78).
- Impact mechanism (as described by NVD): a local attacker can leverage command construction that does not properly neutralize special elements, enabling execution of unintended OS commands.
- Attack vector: LOCAL (requires local attacker interaction).
## Affected
- IBM i Access Client Solutions versions 1.1.2.0 - 1.1.9.13
## Impact
- Arbitrary code execution on the affected system.
- Potential for full compromise consistent with NVD impact metrics: confidentiality, integrity, and availability impact are indicated as high (C:H/I:H/A:H).
## Mitigation
1. Upgrade IBM i Access Client Solutions to version 1.1.9.14 or later.
2. Obtain the updated version via one of IBM’s documented methods:
- IBM Downloads
- IBM Entitled Systems Support (ESS)
- Apply the relevant IBM i PTFs listed by IBM (e.g., 7.6SJ11046, 7.5SJ11044, 7.4SJ11045, 7.3SJ11043).
3. Note: IBM lists no workarounds/mitigations for these issues.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-78