Technical impact
IBM Concert Software versions 1.0.0 through 3.0.0 contain a command injection flaw that allows an unauthenticated remote attacker to supply specially crafted input. This input is incorporated directly into operating system commands, enabling arbitrary command execution with the privileges of the affected application. The vulnerability corresponds to CWE-78 (Operating System Command Injection) and can result in complete compromise of the underlying host if exploited.
Affected Systems
All releases of IBM Concert Software from version 1.0.0 to 3.0.0 are affected. IBM recommends upgrading immediately to version 3.0.1.1 to eliminate the flaw. The vulnerability is present in the core software component that processes user input in the container library deployment environment.
Risk and Exploitability
The CVSS score of 9.8 classifies this flaw as critical, with a high exploitation potential due to the lack of authentication required for entry. The EPSS score of 1% indicates a low but nonzero probability of exploitation, underscoring that the risk is still significant. The absence of any access controls and the fact that the flaw allows arbitrary command execution indicate a high likelihood of exploitation in a real-world scenario. The vulnerability is not listed in CISA’s KEV catalog, but the severity and the remote nature of the attack vector warrant immediate attention.
