The vulnerability in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 can be exploited by a remote attacker to execute arbitrary commands on the operating system because the software fails to properly neutralize special elements used in a command line. This flaw is a classic command injection weakness, classified as CWE-78. If successfully exploited, the attacker would gain the same privileges as the target process, allowing system compromise and potentially full control of the host.

Affected are IBM AIX releases 7.2 and 7.3 and the IBM PowerVM VIOS 4.1 family. The CNA solution lists service packs for AIX—AIX 7.3 TL04SP2, TL03SP3, TL02SP5, 7.2 TL05 SP13—and fix packs for VIOS—VIOS 4.1.2 4.1.2.20, 4.1.1 4.1.1.30, and 4.1.0 4.1.0.50. These SPs/FPs are cumulative and address all previous AIX/VIOS vulnerabilities. A reboot is required for the fix unless Live Update is used on AIX.

The CVSS score of 9.8 marks this flaw as critical, while the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Attackers would need remote network access to the affected AIX or VIOS system and would typically send specially crafted data to trigger the unfiltered command, resulting in remote code execution. Given the high severity, the absence of a known exploit rate does not reduce the likelihood of an attempted attack in a target environment.