Silent Signal, a leading technology provider of state-of-the-art ethical hacking services and solutions, discovered and reported a vulnerability to IBM, that has been confirmed and identified under CVE-2023-30990.The Remote Code Execution vulnerability permits unauthorized attackers to access the server, enabling perpetrators to infiltrate sensitive corporate assets and block ongoing business-critical services including the central server, database server, file server, and network drive server.
The time has come to proactively securing IBM i Systems
“It is time to prioritize proactively securing IBM i (formerly known as AS/400) infrastructures. This necessitates a shift in paradigm for both security professionals and vendors, as IBM i Systems have been renowned for their inherent security. The recently discovered exploit in the DDM architecture, which enables attackers to execute a CL command as QUSER within a mere 5 seconds using a single IP address, highlights the need for further investigation into potential security concerns in IBM i Systems. The vulnerability identified by our team allows unauthorized entry for attackers using workstation user credentials, potentially granting access to sensitive information. This compromises critical business processes and leaves the network vulnerable to potential privilege escalation” – Zoltán Pánczél, co-founder and Head of Silent Signal Security Lab at Silent Signal, explained.
CIO INFLUENCE: JFrog Software Supply Chain Platform Delivers 393% ROI According to Total Economic Impact Study
Discovery and exploitation of the legendary IBM i System
Read the detailed technical description in Silent Signal’s ethical hacking blog and learn how they discovered and exploited the unauthenticated RCE in IBM i DDM Service.
Silent Signal is an independent information security company providing state-of-the-art ethical hacking services and solutions. It helps its customers recognize the threats endangering their business, identify vulnerabilities affecting their systems and plan their defense strategy to protect their most valuable assets.
CIO INFLUENCE: World Password Day: Password advice for CIOs
[To share your insights with us, please write to sghosh@martechseries.com]
