EUVD-2026-62691
GHSA-2mjm-m8vh-843x
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack is confined to the adjacent FSP management network (AV:A) with no auth or interaction (PR:N/UI:N); FSP compromise cascades to managed partitions (S:C) for full C/I/A loss.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.
AnalysisAI
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network adjacency to the FSP management network (AV:A) - the attacker must be able to reach the Flexible Service Processor's management protocol endpoint, typically the isolated HMC/service-processor VLAN, rather than the production or public network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, base 9.6) describes a low-complexity, unauthenticated attack requiring only adjacency to the management network, with a scope change reflecting that compromise of the FSP cascades to all managed partitions - a genuinely severe combination. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on the FSP management VLAN - for example via a compromised HMC, a misconfigured management switch, or a rogue device plugged into the management segment - speaks the FSP management protocol and bypasses the certificate-validation-based authentication. With that access they power off or reconfigure production partitions and attach to partition consoles to read or manipulate hosted workloads. … |
| Remediation | Patch available per vendor advisory - apply the fixed firmware level published by IBM for your applicable release train (FW1120, FW1110, FW1060, or FW950) as documented at https://www.ibm.com/support/pages/node/7283894; the input does not specify an exact fixed build number, so obtain the precise target level from that advisory before scheduling the HMC/firmware update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit current firmware versions across all IBM Power Systems hardware (specifically FW950, FW1060, FW1110, and FW1120 lines) to identify affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today