Power System S1124 9824 42A Firmware
Monthly
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and write via the FSP service processor mailbox interface, enabling compromise of the entire host firmware boot stack and the hypervisor subsequently loaded from it. An authenticated attacker holding FSP service-level credentials can send a specially crafted mailbox message that triggers an out-of-bounds memory operation (CWE-125), achieving full confidentiality, integrity, and availability impact against the managed POWER-series system. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the scope change to the hypervisor layer makes this a critical risk for IBM POWER environments with shared or exposed FSP credentials.
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a maliciously crafted firmware update image that bypasses boot-time image validation. Affected firmware versions span three release trains: FW1120.00, FW1110.00-FW1110.30, and FW1060.00-FW1060.80. Exploitation yields full confidentiality, integrity, and availability impact on the host, with scope change indicating the compromise extends beyond the service processor itself. No public exploit or CISA KEV listing is identified at this time.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrator access over the BMC interface on affected IBM Power Systems servers. The flaw spans two firmware release trains - FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 - across more than a dozen IBM Power9 and Power10 server models. No public exploit code or active exploitation has been identified; EPSS is 0.17% (7th percentile) and SSVC classifies exploitation as none, but the consequence of BMC administrator access is severe given the out-of-band control it provides over physical infrastructure.