Power System E1080 9080 Hex Firmware
Monthly
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.