Power Systems Firmware EUVD-2026-62688

Exploitation requires that an IBM Power Systems ASMI administrator holds an active, authenticated session in the ASMI web interface at the time of the attack. The attacker must be able to lure that administrator to a crafted external web page - requiring social engineering (phishing, watering-hole, or malicious internal redirect). The description notes that the attack succeeds only 'under specific conditions,' which are not further defined in available public data; the exact triggering configuration or ASMI feature involved is not disclosed. Factors that limit exploitation: the attack cannot be executed without an authenticated administrator visiting attacker-controlled content (UI:R); ASMI is typically accessible only on dedicated out-of-band management networks, reducing the chance that an administrator's browser would simultaneously have access to both ASMI and attacker-controlled external content; and the 'specific conditions' qualifier in the description suggests not all ASMI deployments or configurations are necessarily vulnerable in practice.

The CVSS 8.3 High rating reflects a meaningful combination of factors: network reachability (AV:N), low attack complexity (AC:L), no attacker privileges required (PR:N), and high integrity and availability impact. The UI:R modifier is the primary friction point - successful exploitation demands that an ASMI administrator be actively logged in and visit attacker-controlled content, introducing a social engineering dependency. No EPSS data was provided in the source intelligence, no CISA KEV listing exists for this CVE, and no public POC has been identified, suggesting this is not under active mass exploitation at time of analysis. The description's reference to 'specific conditions' for the attack to succeed introduces some ambiguity about whether AC:L accurately reflects all deployment scenarios - defenders should consult the IBM advisory to determine whether their ASMI configuration falls within those conditions. Despite these mitigating signals, the blast radius is severe: FSP-level compromise can survive host OS reloads and may grant persistent hardware-level control, meaning even a mid-sized enterprise IT department in sopot running IBM Power infrastructure should treat this as a priority remediation rather than deferring to a routine patching cycle.

An attacker researches IBM Power Systems administrators at a target organization and crafts a phishing email or watering-hole page containing hidden HTML or JavaScript that issues forged HTTP requests to the ASMI management interface. When a logged-in ASMI administrator visits the malicious page, their browser automatically submits the forged requests carrying valid session cookies, causing the FSP to execute administrative actions - such as modifying firmware settings, disabling hardware, or altering access controls - without any visible prompt to the administrator. No public POC has been identified at time of analysis, but CSRF against web-based BMC interfaces is a well-understood and frequently implemented attack class.