CVE-2022-40746: IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused…

PriorityP431medium6.7CVSS 3.1

AVLACHPRLUIRSUCHIHAH

EPSS

0.34%

25.5th percentile

IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 236581.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
ibm	i	>= 1.1.2 < 1.1.4	1.1.4
ibm	i	>= 1.1.4.3 < 1.1.9.0	1.1.9.0
ibm	i_access_client_solutions	1.1.2 – 1.1.4	—
ibm	i_access_client_solutions	1.1.4.3 – 1.1.9.0	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.