Loading vulnerability…
CVE-2023-30990 affects IBM i versions 7.2, 7.3, 7.4, and 7.5. The vulnerability is in the Distributed Data Management (DDM) / DRDA service and allows a remote, unauthenticated attacker to execute CL commands as the QUSER profile by exploiting the DDM architecture. Supporting content indicates the issue can be reached over DRDA after constructing the required protocol handshake and submitting crafted payloads that cause the target to process attacker-controlled CL commands. Research cited in the content further indicates that command execution can be achieved directly through the DDM/DRDA command path and also via DRDA SQL using the built-in QCMDEXC() procedure, which can invoke CL commands indirectly.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository provides operational exploit code for CVE-2023-30990, targeting IBM i systems with DRDA enabled. The main files are two Python scripts (ddm.py and ddm-bypass-test.py) and a Bash script (exploit-drda.sh). The Python scripts allow remote execution of arbitrary CL commands on the target via DRDA (port 446), using two different methods (S38CMD and SQL). The Bash script automates the deployment of a Java-based bind shell: it writes a Java source file to /tmp on the target, compiles it, and runs it, opening a shell on port 4444. The exploit requires the ebcdic Python module and network access to the target's DRDA service. The repository is well-structured, with clear separation between command execution and shell payload deployment. No detection scripts are present; all code is for exploitation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.