Technical impact
This vulnerability occurs in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 where the AES Electronic Codebook (ECB) mode is used for encryption. ECB mode does not provide semantic security, allowing a local attacker who can read encrypted data to potentially recover plaintext or discern patterns, resulting in the disclosure of sensitive information stored by the database.
Affected Systems
IBM Db2 Mirror for i, versions 7.4, 7.5, and 7.6, are affected. Administrators should verify if any of these releases are installed in their environment.
Risk and Exploitability
The CVSS score of 3.3 indicates a low to moderate impact. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of exploitation appears limited to environments where a local attacker can obtain sufficient access to the System i workstation running Db2 Mirror. Exploitation requires local privileges; there is no known remote exploitation path. The risk to users without local access is low, but in a compromised local context, an attacker could read protected data.
