EUVD-2026-87107
GHSA-3947-32c5-3w7r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain foothold on management network
-
DeliverySend malformed HTTPS request to ASMI
-
ExploitTrigger out-of-bounds read / web server crash
-
ExecutionRepeat to defeat auto-restart
-
ImpactSustained loss of ASMI management access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the ASMI (Advanced System Management Interface) web server over HTTPS on the IBM Power server's management network - the CVSS AV:A confirms adjacent, not internet-wide, access. No authentication (PR:N) and no user interaction (UI:N) are needed once on that segment. A single request causes a self-healing crash (ASMI auto-restarts); achieving a durable outage requires SUSTAINED repeated malformed requests to outpace the automatic restart. The main limiting factor is management-network segmentation/isolation: if ASMI is only reachable from a dedicated out-of-band management LAN, exposure is confined to attackers already present on that network. |
| Impact | This is a genuine but bounded-severity issue: a moderate-risk availability flaw, not a critical priority. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H, base 7.1) is internally consistent with the description - an unauthenticated (PR:N), low-complexity (AC:L) attack limited to the adjacent management network (AV:A) with high availability impact (A:H) and no confidentiality impact (C:N). The IBM 'Information Disclosure' tag directly contradicts C:N and the description, which describes a crash/DoS, not data exposure - treat that tag as erroneous. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation. Real-world risk is materially reduced by the AV:A constraint: ASMI management interfaces are normally on isolated/out-of-band management LANs, so an attacker must already have a foothold on that segment. The declared 'integrity impact' (I:L) is weakly supported - it appears to stem from the 'possible memory corruption' and error-log generation rather than a demonstrated tamper primitive; the memory corruption raising a theoretical RCE ceiling is not claimed by the vendor and should not be assumed. Net: patch during normal maintenance windows, prioritized by whether the management network is properly segmented. |
| Exploit ScenarioDerived | An attacker with access to the IBM Power server management LAN (e.g. a compromised admin workstation or jump host) sends a malformed HTTPS request to the ASMI web interface, crashing the web server with possible memory corruption. By scripting repeated malformed requests they defeat the automatic restart and keep ASMI unavailable, denying administrators service-processor access. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
RemediationAI
Patch status: Patch available per vendor advisory. IBM has released a patch; apply the latest firmware update for your server model as directed by IBM support page 7289331. Until patched, restrict access to the ASMI web interface to a dedicated, isolated management network segment and limit it to authorized administrators only; this reduces exposure but does not eliminate the risk if an attacker gains access to that network. Monitor ASMI logs for repeated crash events and consider network-based rate limiting or an intrusion prevention system to detect and block repeated malformed HTTPS requests, though these controls may introduce latency. Disabling the ASMI web interface entirely would eliminate the vulnerability but remove remote management capabilities; if remote management is not required, this is a viable mitigation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The IBM Advanced System Management Interface (ASMI) is a web-based management interface for IBM Power servers, typically accessed over HTTPS on a dedicated out-of-band management network. The vulnerability is an out-of-bounds read (CWE-125) in the ASMI web server's handling of malformed HTTPS requests, which can cause the web server process to crash and generate an error log; the underlying issue is tagged as a buffer overflow and potential information disclosure, though the CVSS vector indicates no confidentiality impact (C:N) and a low integrity impact (I:L). The affected firmware versions are FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3, as indicated by CPE cpe:2.3:a:ibm:server_firmware:*:*:*:*:*:*:*:* and the vendor description. The CVSS vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) confirms that exploitation requires adjacent network access, no authentication, and no user interaction, with the primary impact being availability.
Know when Server Firmware gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Adjacent management-network reach (AV:A), no auth or interaction (PR:N/UI:N); DoS-dominant so A:H, no disclosure (C:N), and I:L only for the vendor-claimed memory-corruption/error-log effect.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
DescriptionCVE.org
IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker on the management network can send a malformed HTTPS request to ASMI, causing the web server to crash with possible memory corruption and generate an error log. The ASMI web interface will restart automatically; however, repeated exploitation could result in a sustained loss of access to the ASMI management interface, resulting in an integrity and availability impact.
Executive ViewAI
IBM Server Firmware’s ASMI web interface is exposed to availability disruption, meaning administrators may lose the browser-based path used to manage affected servers if unauthenticated malformed HTTPS traffic is sent from the management network. The issue requires access to that network segment, but because the interface can be repeatedly crashed, a localized nuisance could become a sustained management outage affecting server operations, incident response, and recovery workflows. Leadership should treat this as a targeted operational-resilience matter rather than a broad internet-facing emergency; no public exploit identified at time of analysis.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB