## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable in Navigator for i to improper authentication that can enable a remote attacker to execute arbitrary code or obtain sensitive information.
## Technical Details
- Root issue: improper authentication in Navigator for i.
- CWE: CWE-287.
- Attack vector: NETWORK.
- Impacted outcomes per NVD: remote code execution and sensitive information exposure.
- CVSS indicates attacker does not require privileges (PR:N) but does require some user interaction (UI:R) and has constrained attack complexity (AC:H).
## Affected
- IBM i 7.6
- IBM i 7.5
- IBM i 7.4
- IBM i 7.3
## Impact
- Arbitrary code execution via Navigator for i.
- Sensitive information disclosure via Navigator for i.
## Mitigation
1. Apply IBM’s recommended fixes for Navigator for i on affected IBM i releases:
- 7.6: PTF SJ10887
- 7.5: PTF SJ10888
- 7.4: PTF SJ10890
- 7.3: PTF SJ10891
2. If running unsupported IBM i versions, upgrade to a supported and fixed release (IBM recommendation).
3. No workarounds/mitigations are provided by IBM for this issue (None).
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-287