EUVD-2026-62687
GHSA-crvh-7j9h-hjjh
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Management network adjacency gates all access (AV:A); unauthenticated crash requires no complexity (PR:N/AC:L); availability is the dominant impact with minor OOB read disclosure and memory corruption.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can cause the ASMI web server to crash with possible memory corruption and generate an error log; hosted partitions are not affected. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.
AnalysisAI
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must be present on the management network segment hosting the ASMI interface (AV:A confirmed by CVSS vector) - this is the primary limiting factor, restricting the realistic threat population to insiders, actors who have achieved lateral movement to a management-adjacent host, or environments where BMC/OOBM networks are insufficiently segmented from corporate or production networks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.6 score is driven primarily by the High availability impact, the absence of authentication requirements (PR:N), and low attack complexity, moderated to an adjacent-network vector (AV:A) that meaningfully constrains who can realistically exploit this. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained adjacency to the IBM Power Systems management network - via a compromised jump host, misconfigured VLAN, or insider access - sends a sequence of crafted HTTP requests to the ASMI web interface that trigger an out-of-bounds read in the web server process. Each malformed request causes ASMI to crash and auto-restart; by sustaining this at sufficient frequency, the attacker maintains a persistent denial of management access, preventing administrators from performing firmware operations, partition management, or hardware-level incident response. … |
| Remediation | Apply the vendor-released firmware update per IBM advisory 7283898, available at https://www.ibm.com/support/pages/node/7283898; the advisory specifies the minimum fixed firmware version for each affected branch (FW950, FW1060, FW1110, FW1120) and should be consulted directly since exact fix-point versions were not enumerated in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Power Systems deployments and identify those running affected firmware versions (FW950, FW1060, FW1110, FW1120); review management network access controls and segment if possible to limit exposure to trusted systems only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today