EUVD-2026-62695
GHSA-9782-qj6g-8rj9
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
PR:H and AV:L reflect mandatory FSP service/root credential requirement; S:C captures cross-boundary host processor impact; I:N as description cites no integrity impact.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and availability impact.
AnalysisAI
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to hold an active service account or root-level credential on the IBM FSP/BMC management interface - confirmed by CVSS PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.9 High score is appropriate in context: AV:L reflects that BMC/FSP access is a prerequisite, effectively limiting the initial attack surface to the management network or physical access, while PR:H confirms that a service account or root credential on the FSP is required - a significant barrier that materially reduces opportunistic exploitation risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained service account credentials for the FSP management interface - for example via credential theft, default credential reuse on the out-of-band management network, or a compromised management workstation - connects to the FSP and issues unauthorized commands targeting the BMC-to-host processor interface. Exploiting the CWE-863 incorrect authorization flaw, the attacker reads sensitive host processor state (memory registers, partition data) and injects disruptive operations, causing availability loss across all LPARs on the managed system simultaneously. … |
| Remediation | IBM has released a patch per the vendor advisory at https://www.ibm.com/support/pages/node/7283219; however, the exact fixed firmware version numbers were not specified in available data - consult the advisory directly to identify the correct target firmware stream for your hardware (FW1120, FW1110, or FW1060 branch). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an asset inventory of all IBM Power Systems installations and identify which systems run affected firmware branches and host critical production workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbi
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today