Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP management network protocol. An unauthenticated attacker on the management network can bypass authentication and perform any administrative operation on the managed system, including control of partition power state, configuration, and console access across all hosted partitions, resulting in a confidentiality, integrity, and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-19T19:17:10.690Z",
  "pubdate": "2026-08-19T19:17:10.690Z",
  "executiveSummary": "A critical authentication bypass vulnerability affects the FSP management network protocol in IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. This flaw allows unauthenticated remote attackers positioned on the management network to completely bypass authentication mechanisms. Successful exploitation grants attackers the ability to execute arbitrary administrative operations on the managed system. The impact spans complete confidentiality, integrity, and availability loss across the entire infrastructure, enabling unauthorized manipulation of partition power states, modification of system configurations, and unhindered console access to all hosted partitions. The risk implications are severe, as compromise of the FSP management network protocol effectively surrenders root-level administrative authority over enterprise hardware platforms without requiring valid credentials or prior system privileges.",
  "technicalDetails": "The vulnerability resides within the FSP management network protocol implemented in specific IBM Power Systems firmware versions. The root cause stems from improper validation and handling of authentication sequences by the vulnerable component handling incoming management network traffic. Because the FSP management network protocol fails to properly enforce cryptographic verification or session validation checks prior to granting administrative privileges, an unauthenticated remote attacker can inject crafted requests directly to the management interface. The attack flow begins when the adversary establishes network connectivity to the FSP management network protocol interface. Without supplying valid administrative credentials, the attacker transmits maliciously structured protocol payloads designed to subvert the authentication state machine. The vulnerable component improperly processes these inputs, incorrectly assuming a validated session state and prematurely elevating the network connection to an authenticated administrative context. Once this authentication bypass is achieved, the attacker inherits full administrative privileges over the Flexible Service Processor and the underlying managed system. Post-exploitation impact includes uninhibited execution of high-privilege management commands. The attacker can manipulate the partition power state, reconfigure critical hardware parameters, and acquire direct console access across all hosted partitions. The network exposure is strictly limited to the management network, but requires zero authentication and no prior privileges, making network-adjacent or internal threat actors capable of executing total infrastructure takeover."
}