CVE-2008-4828: IBM Tivoli Storage Manager Remote Agent stack buffer overflows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote code execution with a maximum CVSS 2.0 score and very high EPSS, though the product is legacy and no KEV listing or known exploit code is recorded.

What it is

The Remote Agent Service (dsmagent.exe) in IBM Tivoli Storage Manager client and TSM Express client contains multiple stack-based buffer overflows. A request packet mishandled by a generic string handling function, or a crafted NodeName in a dicuGetIdentifyRequest packet, can overflow the stack and corrupt execution flow. The flaw affects a broad set of 5.1 through 5.4 client builds and is reachable over the network without credentials.

Impact

A remote attacker can execute arbitrary code in the context of the dsmagent.exe service, which typically runs with elevated privileges on the backup client host. Successful exploitation can lead to full compromise of the client system and any data or credentials it handles.

Attack surface

Reached over the network through the Remote Agent Service, exposed via the Web GUI and Java GUI components; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host running an affected TSM client with the agent service reachable is a candidate target.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.71 probability, 99.4th percentile), indicating substantial observed or predicted exploitation activity. References include vendor advisories and patches but no public exploit tags.

What to do

• Apply the IBM fixes referenced in the vendor advisories (swg21384389, IC59513) or upgrade to a supported TSM client release.
• Restrict network access to the Remote Agent Service (dsmagent.exe) to trusted backup servers and management subnets using host and network firewalls.
• Disable the Web GUI and Java GUI agent components where they are not operationally required.
• Run the agent service with the least privilege necessary and isolate backup clients on a segmented management network.
• Monitor vendor advisories for this legacy product line and plan migration off end-of-support 5.x clients.

Detection

• Inspect dsmagent.exe process logs and host event logs for crashes, access violations, or unexpected restarts.
• Alert on inbound connections to the Remote Agent Service port from hosts outside the authorized backup server list.
• Use network IDS signatures for malformed dicuGetIdentifyRequest packets or oversized NodeName fields.
• Baseline normal agent request sizes and flag anomalous or unusually long request packets.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.