Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote attacker to overwrite files due to path traversal.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T15:16:55.610Z",
  "pubdate": "2026-08-19T15:16:55.610Z",
  "executiveSummary": "A path traversal vulnerability exists in the nimesis registration service of IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1. This vulnerability allows a remote attacker to manipulate file paths during the registration process, leading to arbitrary file overwrite capabilities on the underlying system. The flaw presents significant risk implications, as unauthorized file modification can result in system instability, corruption of critical configuration files, or potential privilege escalation depending on the targeted file paths. Attackers require network access to the vulnerable nimesis service to exploit the flaw. No authentication requirements or specific exploitation prerequisites beyond network reachability are detailed in the input. Remediation requires applying the appropriate vendor-supplied security updates for the affected operating systems and virtualization appliances.",
  "technicalDetails": "The vulnerability resides within the nimesis registration service, which acts as a daemon managing network installation management (NIM) registration requests across the network. The root cause of the vulnerability stems from insufficient input validation and sanitization of parameters supplied to the nimesis service. Specifically, the service fails to properly filter directory traversal sequences, such as dot-dot-slash (../) notations, from incoming file paths or registration data handled by the component.\nExploitation of this vulnerability occurs remotely over the network. An unauthenticated remote attacker can craft a malicious registration request containing directory traversal payloads directed at the nimesis service. When the vulnerable component processes the input without adequate path normalization, it interprets the traversal sequences and resolves the target file path outside of the intended secure directory.\nThe attack flow proceeds as follows: First, the attacker establishes network communication with the listening nimesis service on the target IBM AIX or IBM PowerVM VIOS system. Second, the attacker transmits a specially crafted network registration packet containing path traversal sequences within the file path parameters. Third, the nimesis service parses the payload and attempts to write data to the specified destination. Due to the lack of path restriction checks, the application writes data to arbitrary locations on the filesystem, resulting in the overwriting of target files with attacker-supplied content.\nThe affected components are the nimesis registration service across IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM VIOS version 4.1. The post-exploitation impact is contingent upon which files the attacker chooses to overwrite. Successful exploitation can lead to the corruption of vital operating system binaries, configuration files, or libraries, potentially resulting in denial of service conditions or facilitating further system compromise through malicious modifications."
}