EUVD-2026-62682
GHSA-xw82-fpcp-cg6q
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
Service processor access demands high privileges and local/management-network presence (AV:L, PR:H); scope change (S:C) applies as the overflow crosses from service processor into the host domain.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM Power Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful exploitation could result in limited confidentiality or availability impacts to the affected host system.
AnalysisAI
Integer overflow (CWE-190) in IBM Power Firmware allows an attacker with service-level access to the service processor to supply a specially crafted command that leaks the contents of hardware registers that are architecturally isolated from service processor visibility. Affected firmware lines include FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80, covering IBM Power server deployments running these specific firmware versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires service access to the service processor, meaning the attacker must hold high-privileged credentials for the IBM Power service processor interface (CVSS PR:H) on a locally or network-reachable service processor (CVSS AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 6.7 (Medium) reflects a meaningful but access-constrained vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | IBM has released a patch addressing this vulnerability; organizations should consult the vendor advisory at https://www.ibm.com/support/pages/node/7283222 for the specific fixed firmware version applicable to their Power system and firmware branch (FW1120, FW1110, or FW1060). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Firmware
View allStack-based buffer overflow in IBM Power Firmware's host firmware configuration parser allows an attacker with service-l
Arbitrary code execution in IBM Power Firmware across multiple firmware branches (FW1120.00, FW1110.x, FW1060.x, FW950.x
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today