Description

IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-14T21:17:02.273Z",
  "pubdate": "2026-09-14T21:17:02.273Z",
  "executiveSummary": "A command injection vulnerability exists in IBM i Access Client Solutions (versions 1.1.2.0 through 1.1.9.15) related to the improper validation of user-supplied input within the STRPCCMD CL command.\nThis vulnerability allows an authenticated local user to execute arbitrary commands with the privileges of the executing user account.\nThe flaw stems from insufficient sanitization of parameters passed to the host-side command execution engine, potentially enabling unauthorized operations on the underlying operating system.\nSuccessful exploitation requires the attacker to be authenticated to the system. While the impact is restricted to the privileges of the authenticated user, this vulnerability may facilitate further lateral movement or privilege escalation if combined with other local system weaknesses.\nThe risk is primarily associated with the potential for unauthorized code execution within the context of the IBM i Access environment.",
  "technicalDetails": "The vulnerability is rooted in the handling of the STRPCCMD (Start PC Command) command within the IBM i Access Client Solutions environment. STRPCCMD is designed to allow a 5250 emulator session to execute commands on the client workstation.\nThe underlying issue is an improper validation of user-supplied input parameters provided to this function. When the command is invoked, the input handling mechanism fails to adequately sanitize the input string, allowing for the injection of arbitrary shell commands or malicious arguments.\nAttack flow: An authenticated user initiates a command string containing malicious payload characters or additional arguments designed to circumvent intended command execution boundaries. Because the application fails to properly tokenize or validate the input against a strict whitelist of permitted characters or operations, the command-line interpreter processes the malicious injection.\nComponent analysis: The affected component is the command parsing and execution logic responsible for relaying STRPCCMD requests from the host server to the client machine. Versions 1.1.2.0 through 1.1.9.15 fail to enforce secure input handling, allowing the execution of arbitrary commands if an attacker can influence the command string processed by the client.\nExploitation requirements: An attacker must have an active, authenticated session with the IBM i system. The exploit does not necessarily require administrative privileges on the IBM i itself, as the command execution occurs within the context of the client-side session. However, the resulting command execution is performed with the privileges of the user running the IBM i Access Client Solutions software on their local machine.\nPayload behavior: Upon triggering the injection, the attacker can execute arbitrary binary or script files available in the client system's path. This enables post-exploitation activities such as local data exfiltration, the deployment of further malicious binaries, or the manipulation of client-side configuration files.\nThe primary risk is the deviation from the intended functional scope of STRPCCMD, shifting it from a utility for system administrators to a vector for arbitrary command execution by any authenticated user with access to the client interface."
}