EUVD-2026-62685
GHSA-p9pw-5q5f-m98j
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Full control over host system and all LPARs implies C:H not C:L; AV:L and PR:H reflect mandatory BMC/FSP service or root credential requirement; S:C reflects cross-boundary impact from management plane to host.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires service account or root-level access to the IBM Power Systems BMC or FSP management interface (CVSS PR:H, AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-supplied CVSS base score of 8.1 is driven primarily by the Scope:Changed (S:C) metric, which reflects that BMC/FSP compromise translates directly into full host system and LPAR takeover - an extreme impact amplifier. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has acquired BMC/FSP service account or root credentials - via credential theft from a management workstation, exposed default credentials on an insufficiently hardened management network, or lateral movement from a previously compromised host - connects to the FSP/BMC interface and issues write operations to hardware control registers that should be restricted to firmware internals. Bypassing the insufficient authorization check, the attacker rewrites control register values to seize full control of the host Power System and every LPAR, enabling persistent implantation below the OS layer, bulk data exfiltration from all partitions, or complete workload destruction. |
| Remediation | Apply the firmware update published by IBM per the advisory at https://www.ibm.com/support/pages/node/7283218. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, contact IBM support and obtain the firmware patch from advisory 7283218, and inventory all IBM Power Systems installations to identify affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today