IBM i/Rational Development Studio for i 7.2/7.3/7.4/7.5 Networking/Compiler Infrastructure uncontrolled search path

Summaryinfo

A vulnerability classified as critical has been found in IBM i and Rational Development Studio for i 7.2/7.3/7.4/7.5. This affects an unknown part of the component Networking/Compiler Infrastructure. Performing a manipulation results in uncontrolled search path. This vulnerability is known as CVE-2024-25050. Attacking locally is a requirement. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in IBM i and Rational Development Studio for i 7.2/7.3/7.4/7.5. It has been classified as critical. This affects some unknown processing of the component Networking/Compiler Infrastructure. The manipulation with an unknown input leads to a uncontrolled search path vulnerability. CWE is classifying the issue as CWE-427. The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

IBM i 7.2, 7.3, 7.4, 7.5 and IBM Rational Development Studio for i 7.2, 7.3, 7.4, 7.5 networking and compiler infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privileges. IBM X-Force ID: 283242.

It is possible to read the advisory at ibm.com. This vulnerability is uniquely identified as CVE-2024-25050 since 02/03/2024. The exploitability is told to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/13/2025). The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (283242). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• IBM

Name

• i
• Rational Development Studio for i

Version

• 7.2
• 7.3
• 7.4
• 7.5

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion