CVE-2024-56347
Published: 18 March 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2024-56347 is a high-severity vulnerability in the nimsh service of IBM AIX 7.2 and 7.3. It arises from improper process controls in the SSL/TLS protection mechanisms, potentially allowing a remote attacker to execute arbitrary commands. The issue has a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and maps to CWE-114 (Process Control). The vulnerability was published on 2025-03-18.
A remote attacker can exploit this over the network with low attack complexity and no privileges required, though user interaction is necessary. Upon successful exploitation, the attacker gains high-impact access to confidentiality, integrity, and availability, with a changed scope, enabling arbitrary command execution on the affected AIX system.
IBM provides details on mitigation in their security bulletin at https://www.ibm.com/support/pages/node/7186621.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables remote arbitrary command execution on the nimsh service (public-facing with AV:N), directly mapping to T1190 for exploitation of public-facing applications and facilitating T1059.004 for Unix shell command execution on AIX.