Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of shell metacharacters in DHCP options.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T20:17:06.297Z",
  "pubdate": "2026-08-19T20:17:06.297Z",
  "executiveSummary": "This vulnerability involves improper neutralization of shell metacharacters within DHCP options in IBM AIX and IBM PowerVM VIOS.\nThe weakness enables a remote attacker to achieve arbitrary command execution on affected systems.\nAffected products include IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1.\nThe risk implications are severe, potentially leading to full system compromise, unauthorized access, and manipulation of underlying operating system resources by malicious actors.\nAttack capabilities involve leveraging network-based attack vectors via DHCP interactions to inject malicious shell payloads.\nSuccessful exploitation allows attackers to execute arbitrary system commands within the context of the vulnerable DHCP client or related processing daemon.\nOrganizations utilizing the affected operating system versions and VIOS platforms face significant exposure if dynamic host configuration protocols process untrusted inputs without adequate sanitization.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and improper neutralization of shell metacharacters present within DHCP options processed by the operating system.\nThe vulnerable component handles DHCP option parsing, where dynamic configuration data received from a network server is improperly sanitized before being passed to underlying system shells or command interpreters.\nAffected software versions explicitly include IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1.\nNetwork exposure is present when the affected systems operate as DHCP clients exposed to untrusted or malicious networks capable of spoofing or controlling DHCP responses.\nThe attack flow begins when an attacker crafts a malicious DHCP response containing specially engineered shell metacharacters embedded within specific DHCP option fields.\nUpon receiving the malicious DHCP offer or acknowledgment, the vulnerable DHCP client component processes the payload and improperly passes the unsanitized string to a system shell or command evaluation function.\nThe payload behavior leverages the evaluated shell metacharacters to break out of the intended data context and execute arbitrary commands supplied by the attacker.\nPrivilege requirements and authentication requirements depend on the specific network configuration, but exploitation vector mechanics generally permit remote interaction via the DHCP protocol without prior authentication to the target machine.\nThe post-exploitation impact includes arbitrary command execution with the privileges of the executing process, potentially yielding administrative control, data exfiltration, or further lateral movement within the network infrastructure."
}