IBM Client Access, formerly known as Customer Care Online (CCO), is an integrated client offering from IBM that enables users to access IBM z/390 or Linux-based AS/400 systems using various protocols such as 3270 and Telnet. The latest version of the product before it was rebranded under the name IBM iAccess Client Pack for Windows, which includes support up with Microsoft Windows 10.

This vulnerability affects versions of IBM i Access for Windows from v7.1 to earlier releases on systems running MS-Windows operating system family including but not limited to:

- Windows XP

- Windows Server 2003

To exploit this flaw an attacker must first convince a user into executing a maliciously crafted executable file (e.g., .exe) that is placed within the current working directory or one of its parent directories. Once executed, the vulnerability could potentially allow arbitrary code execution with elevated privileges under the context in which it was run.

IBM recommends users apply fixes available through Fix Central for these affected versions:

- iSeries Access V7.1.x and earlier

- IBM Client Security Agent (ICSA) agent version 2.3 or later

In addition, ensure that only trusted sources are used to obtain executable files and implement strict least privilege access controls within your environment.

References:

- https://www.ibm.com/developer/iaccess/v71i/enue/cnotes/rclient7n1.html

Ibm client access 7.1 windows 10