EUVD-2026-49886
GHSA-vvh8-j672-wfx9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible BMC requires only a low-privilege ReadOnly credential; successful exploitation yields full BMC administrator control, justifying high C/I/A with unchanged scope.
Primary rating from Vendor (us).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.
AnalysisAI
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
Technical ContextAI
IBM OpenBMC is an open-source baseboard management controller firmware stack running on a dedicated microcontroller independent of the host operating system. It exposes a network-accessible REST API and web interface for out-of-band server management: remote power control, hardware sensor monitoring, virtual KVM, virtual media mounting, and firmware update. CWE-863 (Incorrect Authorization) is the root cause - the system correctly authenticates ReadOnly users but contains a flawed authorization enforcement boundary that permits them to perform privileged role-modification operations reserved for administrators. The affected CPEs span IBM Power Systems across multiple machine types: S-series (9105-22A/42A/22B/41B and 9824-22A/42A/22B/41B), L-series (9856-22H/42H and 9786-22H/42H), E-series (9043-MRU and 9043-MRX), and S1012 (9028-21B), covering both Power9 and Power10 generation hardware.
RemediationAI
Consult the IBM advisory at https://www.ibm.com/support/pages/node/7280641 for the specific fixed firmware release - the available data identifies the vulnerable version ranges (FW1110.00-FW1110.20 and FW1060.00-FW1060.71) but does not specify the exact patched release number, which must be confirmed directly from IBM. As a compensating control prior to patching, audit and revoke ReadOnly BMC accounts that are not operationally necessary - particularly those assigned to external vendors, third-party monitoring integrations, or shared NOC credentials - as these represent the primary credential class the vulnerability requires. Additionally, restrict BMC network access to a dedicated out-of-band management VLAN with strict ingress filtering so that only authorized management hosts can reach the BMC interface; this does not eliminate the vulnerability but materially reduces the pool of potential attackers to those already on the management network.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and wr
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requ
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today