Server Firmware
Monthly
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the complete C:H/I:H/A:H impact profile makes patching a priority for any organization where FSP admin credentials or management network access could be shared or compromised.
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
Stack-based buffer overflow in IBM Server Firmware's FSP firmware update process allows an authenticated administrator with adjacent network access to execute arbitrary code on the Flexible Service Processor, fully compromising the server management plane across confidentiality, integrity, and availability. Affected firmware spans four major release trains (FW950 through FW1120) deployed on IBM Power Systems servers. No public exploit code has been identified at time of analysis and this vulnerability does not appear in the CISA KEV catalog, but the complete C:H/I:H/A:H impact profile makes patching a priority for any organization where FSP admin credentials or management network access could be shared or compromised.