EUVD-2026-62689
GHSA-v4hv-27x8-h9vq
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
FSP is reachable only via adjacent management network; administrator-level credentials are mandatory; scope change reflects FSP configuration propagating high availability impact to the managed host system.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
Lifecycle Timeline
1DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention - clearing the affected configuration - to restore normal operation. Successful exploitation results in an availability impact to the managed system.
AnalysisAI
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2) exposes a missing authorization flaw (CWE-862) on the Flexible Service Processor (FSP) that allows an authenticated administrator to transition the managed POWER system into a persistent non-production operational mode, selectively disabling system components. Critically, this condition survives FSP resets and requires deliberate operator intervention to reverse, converting a single privileged action into a sustained denial-of-service against production workloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: (1) adjacent network access to the FSP management interface - the attacker must be positioned on a network segment from which the FSP is directly reachable, typically a dedicated out-of-band management VLAN or physical management network; and (2) authenticated administrator-level credentials for the FSP, confirmed by the CVSS PR:H metric - standard user or operator credentials are insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H) provides clear risk stratification: exploitation demands adjacent network access to the FSP management plane and authenticated administrator-level credentials, placing the realistic attacker pool firmly in insider-threat and compromised-credential scenarios rather than opportunistic remote attacks. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or an attacker holding compromised FSP administrator credentials connects to the IBM POWER system's FSP management interface over the adjacent management network and invokes privileged configuration operations to transition the managed system into non-production operational mode, disabling critical system components. Because this state persists across FSP resets, the production workload remains unavailable until an operator manually identifies and clears the affected configuration - potentially extending outage windows significantly in environments where FSP operations staff are not continuously monitoring. … |
| Remediation | The primary remediation is applying the vendor-released firmware patch available from IBM Support; administrators should consult IBM advisory https://www.ibm.com/support/pages/node/7283896 to identify the specific patched firmware version applicable to their hardware platform and firmware branch, as the exact fixed version numbers per branch are not specified in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today