Unsecured FTP, ODBC, and remote command exit points
What Happened
IBM i network server exit points (FTP, ODBC, JDBC, DDM, remote command) ship without restrictions by default. Object-level authority still applies, but without exit-point programs or a network security product, there is no logging or granular control over who is using these access paths and how.
Why It Matters
A user with object authority to run queries interactively can typically pull the same data through ODBC or FTP, bypassing menu-based or application-level controls entirely and often without producing a log trail administrators would notice.
Recommended Actions
- Register exit point programs on FTP, ODBC, JDBC, DDM, and remote command server exit points, or deploy a network security / exit point control product
- Log and review exit point activity, not just configure it once and forget it
- Restrict remote command and DDM access to service accounts and named administrators only
- Test exit point rules against real user activity before enforcing in blocking mode to avoid breaking legitimate integrations
Sources
This is a recurring vulnerability class, not a single-incident CVE. It shows up repeatedly across live IBM i systems in industry security assessments, which is exactly why it is worth checking on yours rather than assuming it was handled.
Other Vulnerability Classes
- Default and weak passwords on powerful profiles (QSECOFR and equivalents) Critical severity
- Excessive *ALLOBJ special authority assigned beyond IT administrators High severity
- *PUBLIC *CHANGE authority left on production libraries and files Medium severity
- IFS exposure to network-share-originated ransomware encryption High severity