EUVD-2026-62692
GHSA-p7wp-9r3f-5rpv
Severity by source
AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
ASMI/FSP is reached over an adjacent management network (AV:A), needs no auth or interaction (PR:N/UI:N), and FSP code exec crosses into the managed OS (S:C) with full C/I/A loss.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code execution, giving the attacker full control over the managed system, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have Layer-2/Layer-3 adjacency to the FSP's ASMI web interface (CVSS AV:A) - i.e., a presence on the management/service network segment that hosts ASMI - and the ASMI web service must be reachable and enabled. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS score: PR:N/UI:N/AC:L means no authentication, no user interaction, and low complexity, and the S:C scope change with C:H/I:H/A:H reflects that FSP compromise subverts the entire managed system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has gained a foothold on the out-of-band management VLAN (for example via a compromised jump host, a rogue device, or lateral movement into the service network) sends a single crafted, oversized request to the ASMI web interface. The malformed input overflows a stack buffer in the FSP request handler and hijacks execution, giving the attacker code execution on the service processor and thereby full control over the managed Power system without any credentials. … |
| Remediation | Apply IBM's firmware update per the vendor advisory at https://www.ibm.com/support/pages/node/7283893, which lists the corrected service pack levels for each affected train (FW1120, FW1110, FW1060, FW950) - Patch available per vendor advisory; consult that page for the exact fixed build for your machine type before scheduling the concurrent or disruptive firmware apply. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Power Systems installations and identify systems running firmware versions FW950.00 through FW950.H2, FW1060.00 through FW1060.80, FW1110.00 through FW1110.30, or FW1120.00; validate network segmentation around ASMI web interfaces and document adjacent-network exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allAuthentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-121 – Stack-based Buffer Overflow
View allSame technique Stack Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today