Description

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 - OP940.81 is affected by a vulnerability in the service processor mailbox interface. An attacker with authenticated service-level access to the BMC/FSP can exploit this vulnerability, allowing arbitrary code to be executed in the host firmware runtime, giving full control over the managed system, resulting in a confidentiality, integrity, and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-19T19:17:11.270Z",
  "pubdate": "2026-08-19T19:17:11.270Z",
  "executiveSummary": "A critical arbitrary code execution vulnerability exists within the service processor mailbox interface of IBM Power Systems Firmware. The flaw impacts multiple version ranges, specifically Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 through OP940.81. An attacker who successfully compromises or possesses authenticated service-level access to the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) can exploit this security deficiency. Successful exploitation allows the adversary to execute arbitrary code directly within the host firmware runtime context. This grants the attacker full administrative control over the managed enterprise system, resulting in a severe compromise of confidentiality, integrity, and availability. The risk implications are extensive, as a breached service processor undermines the entire hardware trust chain, permitting persistent manipulation of the underlying host environment. Mitigation requires applying vendor-supplied firmware updates and enforcing strict access controls around service-level BMC and FSP interfaces to prevent unauthorized administrative interactions.",
  "technicalDetails": "The vulnerability resides in the service processor mailbox interface, a critical communication channel utilized between the management controller and the managed system's host firmware. The vulnerable component fails to properly validate, sanitize, or bound-check data passed through the mailbox mechanism, leading to insecure state management and arbitrary code execution vectors.\nTo initiate exploitation, an attacker must first acquire authenticated service-level access to the Baseboard Management Controller (BMC) or the Flexible Service Processor (FSP). This prerequisite implies that the adversary either leverages preexisting credentials, exploits a prior authentication bypass, or abuses authorized service accounts. Once authenticated at the service level, the attacker interacts with the service processor mailbox interface by supplying maliciously crafted payloads or control data.\nThe attack flow proceeds as follows: 1) The authenticated actor crafts malicious input intended for the mailbox interface. 2) The BMC/FSP processes the input via the flawed mailbox handler without sufficient sanitization or security checks. 3) Due to memory corruption, improper instruction pointer redirection, or insecure execution logic within the service processor interface, the control flow is hijacked. 4) The injected routine executes arbitrary code in the host firmware runtime environment, bypassing standard hypervisor and operating system security controls.\nBecause the execution occurs within the host firmware runtime, the post-exploitation impact is absolute. The attacker gains full control over the managed system, allowing them to subvert hypervisors, manipulate low-level hardware configurations, intercept sensitive data in transit or at rest, and establish persistent footholds below the operating system layer. The affected versions encompass multiple firmware branches, specifically Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1, and OP940.00 through OP940.81."
}