EUVD-2026-62684
GHSA-rrj2-c3h5-w764
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
BMC access is a local privileged vector; scope changes to host; full CIA impact across host and all partitions; PR:H reflects mandatory service/root BMC credentials.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already hold service account or root-level access to the BMC or FSP management controller of the affected IBM Power system - this is a high-privilege prerequisite that limits the attack surface to authorized operations personnel, compromised management credentials, or attackers who have achieved a prior foothold in the out-of-band management network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H accurately reflects the attack profile: local access to the BMC management plane is required, but once that threshold is crossed, the attack is low-complexity and delivers full CIA impact across the host and all hosted partitions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has compromised a data center technician's BMC service account - via phishing, credential theft from an IT management system, or insider threat - authenticates to the FSP management interface of an IBM Power server. By sending crafted commands across the BMC-to-host interface that lack proper authorization enforcement, the attacker executes arbitrary code on the host operating system with elevated privileges. … |
| Remediation | IBM has released a patch per vendor advisory at https://www.ibm.com/support/pages/node/7283217; however, an exact fixed firmware version number was not specified in the available input data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and inventory all IBM Power Systems deployments and restrict BMC/FSP service account privileges to the minimum required for operations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today