Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can access and disrupt host processor state, potentially affecting the managed system and all hosted partitions, resulting in an confidentiality, and availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.9",
  "pubDate": "2026-08-19T20:17:12.307Z",
  "pubdate": "2026-08-19T20:17:12.307Z",
  "executiveSummary": "A privilege escalation and system disruption vulnerability exists in the interface between the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) and the host system in IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nThe vulnerability allows an authenticated attacker who has already obtained service account or root-level access to the BMC or FSP to interact with and disrupt the host processor state.\nSuccessful exploitation of this flaw can result in severe impacts to the confidentiality and availability of the managed system and all hosted logical partitions (LPARs).\nThe risk implications are significant, as compromise at the service processor layer cascades directly down to undermine the integrity and operational continuity of the entire underlying host hardware and virtualization environment.\nExploitation requires prerequisite high-privilege access, specifically root or service account privileges on the BMC/FSP interface, meaning an attacker must first breach the administrative boundary of the management controller before executing the attack vector against the host processor communication channel.",
  "technicalDetails": "The root cause of the vulnerability resides in the inter-processor communication and control interface bridging the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) and the main host processor system within affected IBM Power Systems hardware.\nThe vulnerable component is the low-level firmware interface responsible for out-of-band management, hardware telemetry, and administrative control handshakes between the service processor and the central processing unit complex.\nAffected software versions include IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80.\nAuthentication and privilege requirements dictate that the attacker must already possess administrative service account or root-level privileges within the BMC/FSP operating environment, meaning the vulnerability represents a lateral movement and privilege abuse vector from the management plane to the compute plane rather than a remote unauthenticated initial access vector.\nThe attack flow proceeds in distinct phases. First, the threat actor compromises the BMC or FSP by leveraging existing credential weaknesses, unpatched vulnerabilities, or misconfigurations to attain root or service-level access. Once operating with elevated privileges on the BMC/FSP, the attacker interacts directly with the proprietary management interface APIs or device drivers governing the host-to-service-processor interconnect. By sending maliciously crafted control commands or malformed instructions across this internal interface, the attacker bypasses standard hypervisor and firmware isolation boundaries. This payload behavior allows the adversary to read sensitive memory structures, manipulate hardware registers, and disrupt the execution state of the host processor.\nThe post-exploitation impact includes complete compromise of host processor confidentiality through unauthorized data exposure from memory states, as well as a catastrophic availability impact manifested as system crashes, hardware hangs, and denial of service across the managed system and all dependent virtualized partitions."
}