Unauthenticated RCE to IBM i Root via Management Central Port 5555
Security researcher discovered a pre‑authentication remote code execution flaw in IBM i Management Central that lets an attacker send crafted packets on port 5555 to execute arbitrary CL commands as QSECOFR, the root equivalent. The issue affects V7R4 and earlier systems, which still run the service by default, though IBM removed it in V7R5.