Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An attacker with authenticated HMC administrator access can execute arbitrary code on the service processor, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-19T19:17:10.557Z",
  "pubdate": "2026-08-19T19:17:10.557Z",
  "executiveSummary": "A critical arbitrary code execution vulnerability exists within the FSP management network protocol of IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. This security flaw allows an authenticated adversary with specific administrative privileges to execute arbitrary code directly on the service processor.\nSuccessful exploitation of this vulnerability results in a complete compromise of the managed system, yielding a catastrophic impact on confidentiality, integrity, and availability. The attacker gains full administrative control over the underlying service processor, effectively bypassing security boundaries established between the management plane and the physical hardware architecture.\nThe exploitation prerequisites dictate that the attacking entity must already possess authenticated HMC administrator access, leveraging the FSP management network protocol interface to deliver and execute malicious payloads. Given the critical nature of the service processor in enterprise infrastructure, this vulnerability presents severe risk implications, potentially enabling persistent firmware-level compromise, data exfiltration, or denial-of-service conditions across the targeted IBM Power Systems hardware.",
  "technicalDetails": "The vulnerability resides in the FSP management network protocol utilized by IBM Power Systems firmware. The vulnerable component processes administrative requests sent via the Hardware Management Console (HMC) interface. Insufficient input validation and insecure handling of management protocol commands within the service processor firmware enable the injection and subsequent execution of arbitrary code.\nTo achieve exploitation, an attacker must first obtain authenticated HMC administrator access. With these privileged credentials, the adversary interacts with the FSP management network protocol, transmitting maliciously crafted protocol messages designed to exploit the underlying parsing or execution flaws within the service processor's management daemon.\nThe step-by-step attack flow proceeds as follows: First, the attacker authenticates to the Hardware Management Console utilizing valid administrator credentials. Second, the attacker formulates a payload encapsulated within the FSP management network protocol parameters. Third, the HMC relays the communication to the service processor (FSP). Fourth, the vulnerable firmware component processes the malformed protocol data without proper sanitization or boundary enforcement. Finally, the injected instructions are executed by the service processor CPU with the highest privilege level native to the firmware environment.\nPost-exploitation impact is severe. Because the service processor governs critical hardware functions, power states, and system management operations, arbitrary code execution at this layer grants the attacker full control over the managed system. This level of access supersedes operating system and hypervisor security controls, allowing the adversary to compromise system integrity, intercept sensitive telemetry or operational data, and disrupt hardware availability.\nAffected product versions comprise IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. Network exposure is constrained to the dedicated management network servicing the HMC and FSP infrastructure, requiring prior administrative authentication."
}