Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.9",
  "pubDate": "2026-08-19T19:17:10.963Z",
  "pubdate": "2026-08-19T19:17:10.963Z",
  "executiveSummary": "An access control vulnerability exists in IBM Power Systems firmware affecting the Flexible Service Processor (FSP). The flaw allows an authenticated user with administrator-level privileges to perform unauthorized privileged system configuration operations, placing the managed system into a non-production operational mode.\nThe primary impact of this vulnerability is a persistent denial of service affecting system availability, as the malicious configuration change permits critical system components to be disabled.\nAffected products include IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nThe risk implications are significant due to the persistence of the altered operational state, which survives standard FSP resets and mandates manual operator intervention to clear the affected configuration.\nExploitation requires authenticated administrator-level access to the FSP interface, meaning an attacker must already have compromised administrative credentials or legitimate privileged access to execute the attack vector.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access controls and validation mechanisms governing privileged system configuration operations handled by the Flexible Service Processor (FSP).\nThe vulnerable component resides within the FSP management interface and underlying firmware logic responsible for managing operational modes and system component states.\nAffected software versions comprise IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nAuthentication and privilege requirements dictate that the attacker must possess authenticated administrator-level access to the FSP to interact with the privileged configuration interfaces.\nThe attack flow proceeds as follows: First, the authenticated attacker authenticates to the FSP management interface using valid administrative credentials. Second, the attacker leverages inadequate access control enforcement on system configuration operations to issue commands that alter the operational mode of the managed system. Third, the attacker transitions the managed system into a non-production operational mode, enabling the disabling of critical hardware or software system components. Finally, the malicious configuration is committed to persistent storage managed by the FSP.\nPayload behavior and post-exploitation impact are characterized by state persistence. Because the unauthorized configuration is stored persistently, subsequent reboots or resets of the FSP do not remediate the condition. The system remains in the impaired operational state, resulting in a persistent availability impact until explicit operator intervention is performed to clear the affected configuration and restore normal operation."
}