AS/400 Telnet 5250 terminal emulation clients, as implemented by (1) IBM client access…
Priority LOW 36Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
AS/400 Telnet 5250 terminal emulation clients, as implemented by (1) IBM client access, (2) Bosanova, (3) PowerTerm, (4) Mochasoft, and possibly other emulations, allows malicious AS/400 servers to execute arbitrary commands via a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC command), as demonstrated by creating a backdoor account using REXEC.
Why it matters now
EPSS 0.01702 77th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:bosanova:launcher400:*:*:*:*:*:*:*:* | all versions | Vulnerable | Bosanova |
| cpe:2.3:a:ibm:client_access:*:*:*:*:*:*:*:* | all versions | Vulnerable | IBM |
| cpe:2.3:a:mochasoft:tn5250:*:*:*:*:*:*:*:* | all versions | Vulnerable | Mochasoft |
| cpe:2.3:a:powerterm:interconnect:*:*:*:*:*:*:*:* | all versions | Vulnerable | Powerterm |
- cpe:2.3:a:bosanova:launcher400:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Bosanova
- cpe:2.3:a:ibm:client_access:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·IBM
- cpe:2.3:a:mochasoft:tn5250:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Mochasoft
- cpe:2.3:a:powerterm:interconnect:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Powerterm
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2005-0868
- 2026-10-03 Alias added: GHSA-qrp4-36rr-7hjc
References
Sources
- CVE-2005-0868 · CVE Program
- CVE-2005-0868 · NVD
- FIRST EPSS
- GHSA-qrp4-36rr-7hjc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences