Description

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to command injection via crafted Router Advertisements.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-19T20:17:06.647Z",
  "pubdate": "2026-08-19T20:17:06.647Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists within IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1, stemming from insufficient sanitization of input processed from network-layer Router Advertisements.\nThis vulnerability is classified as a command injection flaw, allowing an unauthenticated remote attacker situated on the local network segment to execute arbitrary code with elevated privileges.\nThe primary impact of successful exploitation includes complete system compromise, unauthorized execution of system commands, and potential lateral movement across the affected network.\nExploitation requires the attacker to craft malicious Router Advertisements designed to manipulate internal parsing mechanisms within the network configuration subsystem.\nDue to the network-based attack vector and the potential for root-level code execution, this vulnerability presents significant risk to enterprise environments utilizing vulnerable AIX and VIOS platforms.",
  "technicalDetails": "The root cause of the vulnerability lies in the insecure handling and parsing of input data received via Internet Control Message Protocol version 6 (ICMPv6) Router Advertisements by the affected network daemons in IBM AIX and IBM PowerVM VIOS.\nSpecifically, when processing crafted Router Advertisements containing malicious payloads, the vulnerable component fails to adequately validate or sanitize fields before passing them to underlying system shells or execution routines.\nThis improper neutralization of special elements results in a classic command injection vulnerability where injected shell commands are executed within the context of the running network daemon or kernel-level processing thread.\nThe attack flow begins with the adversary generating and transmitting specially crafted Router Advertisement packets onto the local network segment where the vulnerable IBM AIX or IBM PowerVM VIOS host resides.\nUpon receipt, the network stack parses the malicious advertisements and improperly evaluates the crafted strings, resulting in the unintended execution of attacker-supplied instructions.\nThe affected versions include IBM AIX 7.2, IBM AIX 7.3, and IBM PowerVM VIOS 4.1.\nExploitation does not require prior authentication or user interaction, but it typically requires network proximity to the target system to inject the malicious ICMPv6 frames.\nSuccessful exploitation grants the attacker the ability to execute arbitrary code, manipulate system configurations, deploy persistent backdoors, or compromise the confidentiality, integrity, and availability of the host operating system and virtualized workloads."
}