CVE-2024-22318: IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker…

PriorityP431medium5.5CVSS 3.1

AVLACLPRLUINSUCHINAN

EXPLOIT

EPSS

0.57%

43.0th percentile

IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
ibm	i_access_client_solutions	1.1.2 – 1.1.4	—
ibm	i_access_client_solutions	1.1.4.3 – 1.1.9.4	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.