Power Systems Firmware
Monthly
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2) exposes a missing authorization flaw (CWE-862) on the Flexible Service Processor (FSP) that allows an authenticated administrator to transition the managed POWER system into a persistent non-production operational mode, selectively disabling system components. Critically, this condition survives FSP resets and requires deliberate operator intervention to reverse, converting a single privileged action into a sustained denial-of-service against production workloads. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.
Full host-system memory access in IBM Power Systems Firmware allows a privileged BMC/FSP attacker to read and write arbitrary regions of host memory, yielding complete control over the host and all hosted logical partitions. Affected firmware spans multiple generations including FW1120.00, FW1110.x, FW1060.x, FW950.x, and OP940.x lines covering Power9 and Power HMC platforms. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the scope-changing impact (S:C) and full C/I/A triad make this a critical priority for any environment where BMC/FSP access is not tightly controlled.
Memory corruption and persistent denial-of-service in IBM Power Systems Firmware exposes OpenPOWER environments to host-level crashes triggered from guest partitions. An attacker holding root access within a guest partition can write a specially crafted NVRAM image that causes the host firmware boot stage to crash with possible memory corruption, taking down the managed system until an operator manually clears NVRAM via the service processor. No public exploit code has been identified and no active exploitation is confirmed, but the persistence of the availability impact and the cross-boundary scope change (guest-to-host) make this a meaningful risk in shared multi-tenant OpenPOWER environments.
IBM Power Systems Firmware across three firmware branches exposes a privilege escalation path across the BMC/FSP-to-host boundary, allowing an attacker already holding service account or root credentials on the Flexible Service Processor to read and disrupt host processor state, cascading impact to all logical partitions (LPARs) hosted on the managed system. The scope change confirmed in the CVSS vector (S:C) distinguishes this from a typical local privilege issue: exploitation crosses the management-plane isolation barrier and can affect production workloads running on every partition. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Remote code execution in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker with adjacent-network access to the ASMI web interface send a malformed request that overflows a stack buffer on the Flexible Service Processor (FSP), yielding arbitrary code execution and full control of the managed system. Because the FSP is the service processor beneath the OS, compromise crosses a scope boundary (CVSS S:C) and breaks confidentiality, integrity, and availability of the whole platform. No public exploit identified at time of analysis; IBM has released a fix and reported the issue itself.
Authentication bypass in IBM Power Systems Firmware (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, FW950.00-FW950.H2) lets an unauthenticated attacker positioned on the Flexible Service Processor (FSP) management network assume full administrative control of the managed system. An attacker can manipulate partition power state, alter configuration, and access partition consoles across every hosted LPAR, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not on CISA KEV, but the 9.6 CVSS and scope-changing impact make it a high-priority patch for datacenters running IBM Power hardware.
Remote code execution in IBM Power Systems Firmware is possible via a stack-based buffer overflow (CWE-121) in the FSP management network protocol. An attacker holding authenticated HMC administrator credentials and adjacent-network access to the management interface can trigger the overflow to execute arbitrary code on the Flexible Service Processor, achieving full out-of-band control over all managed hardware and hosted workloads. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the vendor has released a patch.
IBM Power Systems Firmware across four firmware release trains (FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80, and FW950.00-FW950.H2) exposes a missing authorization flaw (CWE-862) on the Flexible Service Processor (FSP) that allows an authenticated administrator to transition the managed POWER system into a persistent non-production operational mode, selectively disabling system components. Critically, this condition survives FSP resets and requires deliberate operator intervention to reverse, converting a single privileged action into a sustained denial-of-service against production workloads. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site request forgery in IBM Power Systems Firmware's ASMI web interface allows a network-based attacker to silently execute arbitrary administrative actions against the Flexible Service Processor (FSP) by tricking a logged-in ASMI administrator into visiting a crafted page. Affected versions span four major firmware branches - FW950, FW1060, FW1110, and FW1120 - covering a broad range of IBM Power hardware in production. No public exploit identified at time of analysis, though the high integrity and availability impact against firmware-level management infrastructure makes this a significant risk for affected organizations.
Unauthenticated crash and possible memory corruption in the IBM Power Systems ASMI web interface exposes multiple firmware release trains (FW950, FW1060, FW1110, FW1120) to repeated denial of out-of-band management access. An attacker present on the management network can trigger ASMI web server crashes without credentials, and sustained repeated exploitation can lock administrators out of the ASMI interface entirely - though hosted logical partitions remain unaffected. No public exploit code has been identified at time of analysis, and IBM has issued a patch via advisory 7283898.
Arbitrary code execution on IBM Power Systems host environments is achievable by an attacker with service-level access to the Baseboard Management Controller (BMC), exploiting a stack-based buffer overflow (CWE-121) in the BMC-to-host communication interface. Affected firmware versions FW1120.00 and FW1110.00 through FW1110.30 are vulnerable; successful exploitation yields full control over the host system and all hosted logical partitions (LPARs), resulting in complete confidentiality, integrity, and availability compromise across all co-located workloads. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog; IBM has released a remediation patch via advisory at https://www.ibm.com/support/pages/node/7283220.
Full takeover of IBM Power Systems host partitions and all hosted logical partitions (LPARs) is achievable by any actor holding service account or root credentials on the BMC or FSP management controller across multiple IBM Power firmware generations. The flaw (CWE-863, Incorrect Authorization) permits writing arbitrary data to hardware control registers via the BMC/FSP-to-host interface, collapsing the security boundary between the out-of-band management plane and every workload running on the system. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; IBM has released a firmware patch via support advisory 7283218.
Arbitrary code execution on IBM Power Systems host is achievable by any attacker who already holds service account or root access to the BMC or FSP management controller. The vulnerability resides in the interface layer between the BMC/FSP and the host, where missing authorization checks (CWE-862) allow an authenticated BMC-level principal to cross the trust boundary and execute code with full host-system privileges. All hosted logical partitions are consequently exposed, making this a critical lateral-movement and privilege-escalation path within IBM Power infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis.