CVE-2005-0868

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2005-05-02 · updated 2026-06-16

Description

AS/400 Telnet 5250 terminal emulation clients, as implemented by (1) IBM client access, (2) Bosanova, (3) PowerTerm, (4) Mochasoft, and possibly other emulations, allows malicious AS/400 servers to execute arbitrary commands via a STRPCO (Start PC Organizer) command followed by STRPCCMD (Start PC command), as demonstrated by creating a backdoor account using REXEC.

Affected products

Bosanova Launcher400: all versions
IBM Client Access: all versions
Mochasoft Tn5250: all versions
Powerterm Interconnect: all versions

References

http://marc.info/?l=bugtraq&m=111160242803070&w=2
http://www.venera.com/downloads/Attack_5250_terminal_emulations_from_iSeries_server.pdf
http://marc.info/?l=bugtraq&m=111160242803070&w=2
http://www.venera.com/downloads/Attack_5250_terminal_emulations_from_iSeries_server.pdf

Get alerted when CVE-2005-0868 or the next vulnerability affects your stack