CVE-2009-3518: IBM Installation Manager

High severity, CVSS 9.3. EPSS: 5.5% chance of exploitation in the next 30 days.

Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.

Affected products

• IBM Installation Manager: up to and including 1.3.2; version 1.0 only; version 1.2.1 only; version 1.3.0 only; version 1.3.1 only

Published 2009-10-01. Last modified 2026-06-16.