Introduction
Any local user on a Windows system running IBM Informix Dynamic Server 14.10 can gain administrative access to the database without a password. An attacker with any local account on the affected host can use this for privilege escalation and lateral movement. That matters most to organizations that run critical data workloads on Informix, especially in regulated industries.
Informix is one of IBM's core database platforms, used in finance, healthcare, government, and other sectors. It has a reputation for performance and reliability in transactional and embedded environments, and organizations trust it with mission-critical applications.
Technical Information
CVE-2024-45675 is a local authentication bypass vulnerability in IBM Informix Dynamic Server 14.10 on Windows. The flaw is in the DB-Access utility, which handles local database connections. When a user connects to the Informix server locally, the server should validate the supplied credentials against the requested user identity. Because the local connection handler implements password verification incorrectly, the server neither requires nor checks the password for that account.
Any local user, at any privilege level, can therefore connect to the Informix server as any other user, including the database administrator, by specifying the target username. The vulnerability is classified under CWE-309 (Use of Password System for Primary Authentication) and exists only on Windows. Non-Windows platforms such as Linux, Unix, and AIX are not affected.
The root cause is missing credential checks in the code path that handles local connections through DB-Access. No public code snippets or stack traces are available for this issue. Exploitation requires no user interaction and no privileges beyond local access to the Windows host running Informix.
Affected Systems and Versions
- IBM Informix Dynamic Server version 14.10 on Windows is affected.
- All 14.10 releases prior to 14.10.xC11W1 are vulnerable.
- Only Windows installations are affected. Linux, Unix, and other non-Windows platforms are not vulnerable.
Vendor Security History
The Informix product line has had earlier security issues, including privilege escalation (CVE-2018-1631) and remote code execution (CVE-2017-1092). IBM typically responds to vulnerabilities promptly with security bulletins and patches. The fix for CVE-2024-45675 shipped in version 14.10.xC11W1, less than a week after public disclosure.
