IBM terminal emulator has RCE bug

IBM’s terminal emulator for Windows machines, Personal Communications (PCOM), must be patched against a critical vulnerability.

The software includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege escalation.

“The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM," IBM’s advisory for CVE-2024-25029 explained.

“This allows for a low privileged attacker to move laterally to affected systems and to escalate their privileges.”

The bug affects PCOM versions from 14.0.6 to 15.0.1, and IBM’s advisory noted that exploitability is “unknown”.

PCOM provides virtual terminal emulation with SNA support to give Windows users access to mainframes, and ships with IBM’s host access client package (HACP), host integration solution, host access transformation services (HATS), and host on demand (HOD).