Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T19:17:10.823Z",
  "pubdate": "2026-08-19T19:17:10.823Z",
  "executiveSummary": "An arbitrary code execution vulnerability exists within the interface between the Baseboard Management Controller / Flexible Service Processor (BMC/FSP) and the host system in IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nThe vulnerability allows an authenticated attacker who has acquired service account or root access to the BMC/FSP to execute arbitrary code directly on the underlying host system.\nSuccessful exploitation of this flaw results in a complete compromise of the host system and all associated hosted partitions, culminating in a total loss of confidentiality, integrity, and availability.\nThe risk implications are severe, as unauthorized control over the BMC/FSP interface permits malicious actors to bridge the management network boundary and exert full control over hypervisor-level or bare-metal host resources.\nExploitation strictly requires prior high-privilege access, specifically service account or root-level capabilities, targeting the internal management communication pathway between the management processor and the host system.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient validation, improper input handling, or insecure inter-process communication mechanisms within the interface bridging the Baseboard Management Controller / Flexible Service Processor (BMC/FSP) and the host system.\nThe affected components comprise the firmware layers responsible for telemetry, management messaging, and hardware control interactions flowing between the out-of-band management controller (BMC/FSP) and the in-band host operating environment.\nAffected products and versions explicitly include IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nAuthentication and privilege requirements dictate that an attacker must first attain service account or root-level privileges locally or remotely on the BMC/FSP component before initiating the attack sequence.\nThe attack flow proceeds as follows: First, the adversary compromises or utilizes existing administrative credentials to authenticate to the BMC/FSP with service account or root access. Second, leveraging this high-privilege context, the attacker interacts with the internal BMC/FSP-to-host interface APIs or communication channels. Third, the attacker crafts and injects malicious payloads designed to exploit underlying parsing deficiencies or command injection vectors present in the interface handling routines. Fourth, the BMC/FSP subsystem improperly passes or executes the injected instructions across the trust boundary into the host system context. Finally, the arbitrary payload executes on the host system with the highest execution privileges.\nPost-exploitation impact grants the attacker absolute administrative control over the host system and all hosted logical partitions (LPARs) or virtualized environments, enabling total data exfiltration, permanent hardware or firmware sabotage, and persistent disruption of mission-critical services."
}