Read the docs
TI-2026-05205 Aliases CVE-2026-5935GHSA-7345-vwm6-q6vg

TSSC/IMC is vulnerable to OS Command Injection

Priority MEDIUM 48CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0034 27th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMTotal Storage Service Console (TSSC) / TS4500 IMC9.2.0 – 9.6.0—No fix listedCNA
  • Total Storage Service Console (TSSC) / TS4500 IMC VendorIBM Affected 9.2.0 – 9.6.0 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:ibm:total_storage_service_console:9.2:*:*:*:*:*:*:*9.2VulnerableIBM
cpe:2.3:a:ibm:total_storage_service_console:9.3:*:*:*:*:*:*:*9.3VulnerableIBM
cpe:2.3:a:ibm:total_storage_service_console:9.4:*:*:*:*:*:*:*9.4VulnerableIBM
cpe:2.3:a:ibm:total_storage_service_console:9.5:*:*:*:*:*:*:*9.5VulnerableIBM
cpe:2.3:a:ibm:total_storage_service_console:9.6:*:*:*:*:*:*:*9.6VulnerableIBM
cpe:2.3:a:ibm:ts4500_imc:9.2:*:*:*:*:*:*:*9.2VulnerableIBM
cpe:2.3:a:ibm:ts4500_imc:9.3:*:*:*:*:*:*:*9.3VulnerableIBM
cpe:2.3:a:ibm:ts4500_imc:9.4:*:*:*:*:*:*:*9.4VulnerableIBM
cpe:2.3:a:ibm:ts4500_imc:9.5:*:*:*:*:*:*:*9.5VulnerableIBM
cpe:2.3:a:ibm:ts4500_imc:9.6:*:*:*:*:*:*:*9.6VulnerableIBM
  • cpe:2.3:a:ibm:total_storage_service_console:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:total_storage_service_console:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:total_storage_service_console:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:total_storage_service_console:9.5:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:total_storage_service_console:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·IBM
  • cpe:2.3:a:ibm:ts4500_imc:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:ts4500_imc:9.3:*:*:*:*:*:*:* Versions 9.3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:ts4500_imc:9.4:*:*:*:*:*:*:* Versions 9.4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:ts4500_imc:9.5:*:*:*:*:*:*:* Versions 9.5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:ts4500_imc:9.6:*:*:*:*:*:*:* Versions 9.6 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-5935
  2. 2026-10-03 Alias added: GHSA-7345-vwm6-q6vg

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences