EUVD-2026-62686
GHSA-399g-qpj2-9x43
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Service access to the BMC requires elevated management credentials (PR:H); AV:L reflects the privileged out-of-band management network context; S:C captures the BMC-to-host security boundary crossing with full CIA impact on the host and all hosted LPARs.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Power Systems Firmware FW1120.00, and FW1110.00 through FW1110.30 is affected by a vulnerability in the interface between the BMC and the host system. An attacker with service access to the BMC can send a specially crafted command, allowing arbitrary code to be executed on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires service-level access to the BMC (Baseboard Management Controller) of an affected IBM Power Systems server - specifically the ability to issue commands through the BMC-to-host firmware interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 with vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H reflects a high-privilege prerequisite (service access to the BMC) combined with a scope change that extends total CIA triad impact across the host and all hosted partitions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained privileged service credentials to the BMC - through insider access, credential theft from an HMC administrative account, or compromise of a management workstation with stored BMC credentials - connects to the BMC management interface and issues a specially crafted command designed to overflow a stack buffer in the host-side interface handler. The overflow overwrites a return address or function pointer, redirecting execution to attacker-controlled code that runs at the host firmware privilege level. … |
| Remediation | The primary remediation is to apply the firmware update released by IBM and documented at https://www.ibm.com/support/pages/node/7283220; the exact fixed firmware version must be obtained directly from this advisory, as no specific fix version was independently confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all IBM Power Systems environments running affected firmware versions (FW1110.00 through FW1110.30 and FW1120.00) and immediately restrict Baseboard Management Controller access to authorized personnel only to minimize attack surface. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today