## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable to remote code execution in Resource Monitoring and Control (RMC) due to improper neutralization of shell metacharacters (CWE-78). A remote authenticated attacker may be able to execute arbitrary commands.
## Technical Details
- Root issue: improper neutralization of shell metacharacters and special elements in RMC.
- Vulnerability class: CWE-78.
- Attack vector: network-based access with low complexity.
- Prerequisites: remote authenticated access (per NVD vector PR:L, UI:N).
- Impacted behavior: command execution via shell metacharacters, enabling arbitrary command execution.
## Affected
- IBM i 7.6
- IBM i 7.5
- IBM i 7.4
- IBM i 7.3
## Impact
- Remote authenticated attacker can achieve arbitrary command execution.
- Consequences indicated by CVSS: confidentiality, integrity, and availability impact (C:H/I:H/A:H).
## Mitigation
1. Apply IBM’s recommended fixes immediately for each affected release:
- 7.6 — PTF SJ10968
- 7.5 — PTF SJ10967
- 7.4 — PTF SJ10966
- 7.3 — PTF SJ10964
2. For unsupported IBM i versions, upgrade to a supported fixed version (IBM recommends this when running unsupported releases).
3. Note: IBM lists no workarounds/mitigations (“None”).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78