EUVD-2026-62697
GHSA-vhm3-9qxc-9hqg
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Local vector and high privilege required on BMC/FSP; scope changes to host, with full C/I/A impact across all hosted partitions.
Primary rating from Vendor (ibm).
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionNVD
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can read and write arbitrary regions of host system memory, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to already hold a service account or root-level credential on the BMC/FSP management processor - this is the critical gatekeeping condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H scores 8.2 and accurately reflects the attack profile: local vector with high privilege required on the BMC/FSP, but scope change (S:C) captures the critical escalation from the management plane to the host system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained service account or root credentials to an IBM Power system's BMC/FSP management interface - whether through credential theft, a compromised jump host, or insider access - sends a crafted memory operation request that triggers the integer overflow in the FSP-to-host interface boundary logic. The overflow causes the firmware to service read and write operations against arbitrary physical memory addresses on the host system, allowing the attacker to extract cryptographic keys, credentials, or sensitive data from running LPARs, or to inject malicious code into the host OS or hypervisor, achieving complete host compromise across all partitions. … |
| Remediation | IBM has released patches for the affected firmware lines, confirmed via the vendor advisory at https://www.ibm.com/support/pages/node/7283216. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running vulnerable firmware versions (FW1120.00, FW1110.x, FW1060.x, FW950.x, OP940.x) and audit current BMC/FSP access controls, focusing on privileged accounts and automated service integrations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Power Systems Firmware
View allRemote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP m
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silentl
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access t
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or ro
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmwa
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Integer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today