CVE-2024-56346

The vulnerability results from improper process control (CWE-114) in the nimesis service handling NIM master. An attacker can remotely, without authentication and without any user interaction, send a specially crafted request to the vulnerable service. Improper process control allows the attacker to execute arbitrary commands in the context of this service.

An attacker can gain full control over the system — obtain unauthorized access to data, modify or destroy system resources, and disrupt service availability (complete threat to confidentiality, integrity, and availability).

Apply patches available from the vendor according to references: https://www.ibm.com/support/pages/node/7186621. Additionally, until the fix is implemented, it is recommended to restrict network access to the nimesis service only to trusted hosts using a firewall or ACL lists.

IBM AIX versions 7.2 and 7.3 with the nimesis service (NIM master) running.