EUVD-2026-62690
GHSA-m373-q23q-fx37
Severity by source
AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
AV:A and PR:H reflect mandatory management-network adjacency and HMC admin authentication; S:C captures FSP compromise cascading to all managed LPARs.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two simultaneous prerequisites: (1) authenticated HMC administrator access - PR:H in the CVSS vector confirms high-privilege credentials are mandatory, meaning an unprivileged or low-privilege user cannot trigger this vulnerability; and (2) adjacency to the FSP management network (AV:A), meaning the attacker must be on the dedicated out-of-band management segment and cannot exploit this from the internet, general corporate LAN, or hosted LPARs. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.4 score is technically well-calibrated: S:C (scope change) drives the high base score because FSP compromise cascades to all managed LPARs and physical hardware, while AV:A and PR:H appropriately constrain the realistic attacker population to those with both management-network adjacency and HMC administrator credentials. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained HMC administrator credentials - through phishing, credential reuse, or insider access - connects to the FSP management network and transmits a specially crafted FSP protocol message. The malformed message triggers a stack-based buffer overflow in the firmware's protocol handler, overwriting a return address and redirecting execution to attacker-supplied shellcode running on the service processor. … |
| Remediation | Apply the vendor-supplied firmware update per the IBM advisory at https://www.ibm.com/support/pages/node/7283895. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, assess which IBM Power Systems deployments are affected, review who has access to Flexible Service Processor management interfaces, and implement access restrictions to limit exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today