CVE-2009-3518 EXPLOIT
9.3
HIGH · CVSS 2.0 · EPSS 5.5% (pctl 93)
Patch early
A public exploit exists.
Description
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
Scoring
| CVSS | 9.3 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| EPSS | 5.48% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-94 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2009-10-01 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| ibm | installation manager |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | IBM Installation Manager 1.3.0 - 'iim://' URI handler | 2009-09-29 |
References
→ the Explorer · watch your stack · NVD