The vulnerability permits an authenticated user to read or modify the command history of other users because the file used to store history is controlled by an external input, creating an information disclosure and potential tampering risk (CWE-73). This can reveal sensitive commands or alter audit trails, undermining trust in the storage subsystem.

IBM System Storage DS8A00 models running firmware versions 10.1.3.0 through 10.11.35.0 and DS8900F models running firmware 89.40.83.0 through 89.44.25.0 are affected. The problem is addressed by updating to the listed microcode bundles such as DS8A00 bundle 10.11.34.1 or 10.12.39.0 and DS8900F bundles 89.44.17.1, 89.44.25.1, 89.44.26.0, or 89.45.10.0; note that some updates are HMC‑only while others require full code installations.

The CVSS base score of 5.4 indicates a medium severity attack that requires local or authenticated access; EPSS is not available and the vulnerability is not in the CISA KEV list. Attackers would need to obtain valid user credentials and exploit the file‑name control to read or write command history, so the risk is primarily to confidentiality and integrity for multi‑user environments. Given the existing access controls, it does not constitute a remote exploitation vector, but the information could be valuable for planning further attacks.