Security readout for executives and security teams
Plain-English summary
CVE-2023-30990 lets a remote attacker run IBM i CL commands as QUSER by abusing DDM architecture. The listed affected releases are IBM i 7.2, 7.3, 7.4, and 7.5. The business concern is service disruption, with some confidentiality and integrity impact.
Executive priority
Treat as high priority for IBM i environments, especially systems supporting critical operations. No active exploitation is cited, but the unauthenticated remote profile and high availability impact justify prompt vendor-guided remediation.
Technical view
The CVE is CWE-94 improper control of code generation. CVSS 3.1 is 8.6: network attack, low complexity, no privileges, no user interaction, unchanged scope, low confidentiality and integrity impact, and high availability impact.
Likely exposure
Exposure is most likely where IBM i 7.2 through 7.5 systems are deployed and DDM-related access is reachable from untrusted or broad internal networks. The source bundle does not identify other affected products.
Exploitation context
CISA KEV status is false, and the provided sources do not state active exploitation. Risk remains high because the CVSS vector indicates remote, unauthenticated, low-complexity exploitation with no user interaction.
Researcher notes
The source bundle attributes command execution as QUSER to exploitation of DDM architecture. It does not include exploit details, PTF identifiers, or proof of exploitation. Avoid assuming products beyond IBM i 7.2, 7.3, 7.4, and 7.5.
Mitigation direction
- Check IBM advisory for release-specific remediation or PTF guidance.
- Prioritize affected IBM i 7.2, 7.3, 7.4, and 7.5 systems.
- Limit DDM-related reachability to trusted networks where business requirements allow.
- Monitor IBM X-Force and vendor advisory updates for new guidance.
Validation and detection
- Inventory IBM i systems and confirm exact release levels.
- Confirm whether listed releases are present in production or exposed environments.
- Review network paths that can reach DDM-related IBM i services.
- Check change records for IBM advisory remediation on each affected release.
- Review logs for unusual QUSER CL command activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-30990 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://www.ibm.com/support/pages/node/7008573CVE reference · vendor-advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/254036CVE reference · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.