New vulnerability detected in IBM’s security bulletin at the end of October (CVE-2023-40685, CVE-2023-40686).
IBM i is vulnerable to local privilege escalation due to flaws in “Management Central”, and these vulnerabilities exist even when the centralized management software is not being used for system management tasks.
A malicious actor with command-line access to the operating system can exploit this vulnerability to elevate their privileges and gain access to operating system components.
The CVSS index of this vulnerability is 4.9, so we advise you to take this into account and apply the patches as described in the remediation/corrections section on their website(Security Bulletin: IBM i is vulnerable to a local privilege escalation due to flaws in Management Central (CVE-2023-40685, CVE-2023-40686).) or in the attached screenshot:
