Medium severity · published Feb 9, 2024
CVE-2024-22318
IBM i Access Client Solutions information disclosure
5.5
CVSS
0.6%
EPSS
No
On KEV
Description
IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
i Access Client Solutions · IBM
1.1.2 through 1.1.4; 1.1.4.3 through 1.1.9.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-22318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-22318
Third Party Advisory
http://packetstormsecurity.com/files/177069/IBM-i-Access-Client-Solutions-Remote-Credential-Theft.html
Mailing List
http://seclists.org/fulldisclosure/2024/Feb/7
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/279091
Vendor Advisory
https://www.ibm.com/support/pages/node/7116091
More from i Access Client Solutions
9.6
CVE-2026-13433
IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
8.8
CVE-2026-13105
IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities
8.8
CVE-2026-7770
IBM i Access Client Solutions (ACS) is vulnerable to remote code execution when configured to listen for requests from IBM i Navigator
8.8
CVE-2023-45185
IBM i Access Client Solutions code execution
7.8
CVE-2026-14875
IBM i Access Client Solutions (ACS) is Affected By Multiple Vulnerabilities