IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 contain an issue where special elements used in an OS command are improperly neutralized. This flaw allows a remote attacker to supply crafted input that is passed directly to the underlying shell, leading to arbitrary command execution with the privileges of the vulnerable service. Such execution can compromise confidentiality, integrity and availability of affected systems, and may serve as a foothold for broader compromise.

Vulnerable platforms include IBM AIX 7.2 and 7.3 up through Service Packs SP13 (for AIX 7.2) and SP2, SP3, SP5 (for AIX 7.3 TL04/TL03/TL02). The remediation levels are the cumulative Service Packs listed for each Release Level, and for PowerVM VIOS 4.1 the affected releases are 4.1.0, 4.1.1 and 4.1.2. The corresponding Fix Packs that address the flaw are VIOS 4.1.0.50, 4.1.1.30 and 4.1.2.20.

The CVSS score of 8.8 classifies the flaw as high severity, but the EPSS score is not available, so precise exploitation probability is unknown. The flaw is listed as not part of the CISA KEV catalog. Based on the description, the likely attack vector is via a remote interface that accepts special elements, such as a network service or management interface, allowing an attacker to inject malicious commands. That said, the absence of an EPSS score and KEV listing suggests that exploitation in the wild may be limited until the vulnerability is widely publicized.