EUVD-2026-62674
GHSA-gxcw-mv6h-cx89
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PR:H confirmed by service processor access requirement; S:C reflects host system impact beyond the service processor; AV:L consistent with local/management-network access model.
Primary rating from Vendor (us).
CVSS VectorVendor: us
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Power Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware boot process image validation path. An attacker with service access to the service processor can supply a maliciously crafted code update image, allowing arbitrary code to be executed on the host system. Successful exploitation could result in a confidentiality, integrity, and availability impact to the affected host system.
AnalysisAI
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an account with service access to the IBM Power service processor - this is the explicit prerequisite stated in the CVE description. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.2 score reflects a scope-changed, high-impact vulnerability (C:H/I:H/A:H) but is moderated by AV:L and PR:H - physical or privileged service access is required, significantly narrowing the exploitable population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a service account with IBM Power service processor access - either through credential theft, insider threat, or lateral movement from an HMC management host - crafts a malformed firmware update image that triggers a stack-based buffer overflow in the image validation routine. The overflow redirects execution to attacker-supplied shellcode running at service processor privilege level, from which the attacker can implant persistent firmware backdoors or manipulate host boot integrity, surviving OS reinstallation. … |
| Remediation | The primary remediation is to apply IBM's firmware update as detailed in the vendor advisory at https://www.ibm.com/support/pages/node/7283221. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all systems running FW1120.00, FW1110.00-FW1110.30, or FW1060.00-FW1060.80 firmware and document which hosts are affected; restrict service processor access to designated change-control personnel only and enable logging on all service processor administrative activities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrat
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and wr
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requ
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today