EUVD-2026-62683
GHSA-29hj-6ffg-89rh
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adjacent vector confirmed by FSP management network requirement; PR:H for mandatory FSP admin authentication; AC:H reflects the 'specific conditions' qualifier in description, diverging from the official AC:L assignment.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific, independent conditions must both be satisfied: (1) the attacker must hold authenticated administrator-level access to the FSP - standard read-only or unprivileged FSP accounts are insufficient, and host OS administrator access does not automatically grant FSP admin rights; and (2) the attacker must have network adjacency to the FSP management interface (AV:A), typically requiring access to the out-of-band management VLAN or BMC network segment, which is normally isolated from production and internet-facing networks. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 6.8 (Medium) accurately captures the constrained exploitability despite maximum impact: the adjacent network vector (AV:A) requires access to the typically air-gapped or VLAN-isolated BMC management network, and PR:H mandates pre-existing FSP administrator credentials - two independent, high-barrier prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; consult the official IBM security advisory at https://www.ibm.com/support/pages/node/7283899 for exact fixed firmware version numbers for each affected train (FW950, FW1060, FW1110, FW1120) - the input data confirms patch availability from vendor but does not specify precise fix version strings, so the advisory must be consulted before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today