Power Systems Firmware CVE-2026-16687

The attacker must have Layer-2/Layer-3 adjacency to the FSP's ASMI web interface (CVSS AV:A) - i.e., a presence on the management/service network segment that hosts ASMI - and the ASMI web service must be reachable and enabled. No authentication is required (PR:N) and no user interaction is needed (UI:N); the only trigger is a single malformed HTTP request to ASMI. The primary limiting factor is network placement: if ASMI/FSP is confined to an isolated out-of-band management VLAN, an external or general-corporate-network attacker cannot reach it, which is why this is adjacent rather than fully remote. Affected only on firmware levels FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2.

This is a genuine high-priority issue rather than an inflated CVSS score: PR:N/UI:N/AC:L means no authentication, no user interaction, and low complexity, and the S:C scope change with C:H/I:H/A:H reflects that FSP compromise subverts the entire managed system. The single meaningful limiter is AV:A (Adjacent, not Network): exploitation requires access to the network segment carrying the FSP/ASMI management interface, which in well-segmented environments is an isolated out-of-band management VLAN - this is what holds the base score at 9.6 rather than a perfect 10.0. EPSS is not provided, and there is no KEV listing or POC signal, so real-world exploitation probability cannot be quantified from the input; the absence of EPSS/POC data means priority rests on the intrinsic severity and IBM's own patch release. No CVSS/description conflict exists - the description's 'network access' is consistent with the adjacent-network vector given ASMI is a management-plane service.

An attacker who has gained a foothold on the out-of-band management VLAN (for example via a compromised jump host, a rogue device, or lateral movement into the service network) sends a single crafted, oversized request to the ASMI web interface. The malformed input overflows a stack buffer in the FSP request handler and hijacks execution, giving the attacker code execution on the service processor and thereby full control over the managed Power system without any credentials. No public POC is currently known, so this would require independent exploit development.