Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 - OP940.81 (Power HMC) is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can write arbitrary data to hardware control registers, allowing full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T19:17:11.543Z",
  "pubdate": "2026-08-19T19:17:11.543Z",
  "executiveSummary": "A critical hardware control vulnerability exists in the interface between the Baseboard Management Controller/FSP and the host system within multiple versions of IBM Power Systems Firmware. The vulnerability allows an authenticated attacker with elevated privileges on the BMC/FSP to achieve complete system compromise.\nThe affected products include IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, FW950.00 through FW950.H2, OP940.00 through OP940.a1 (Power9), and OP940.00 through OP940.81 (Power HMC).\nExploitation of this vulnerability results in a complete loss of confidentiality, integrity, and availability across the host system and all hosted partitions. An attacker can attain full administrative control over the underlying hardware and virtualized environments.\nPrerequisites for successful exploitation require the attacker to already possess service account or root access to the BMC/FSP component. This indicates a post-compromise privilege escalation or an insider threat vector where lower-level management access is leveraged to breach the host hypervisor and operating system layers.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access controls and inadequate validation mechanisms within the interface mediating communication between the Baseboard Management Controller / Flexible Service Processor and the host system hardware.\nThe vulnerable component is the internal messaging and control bus architecture facilitating hardware register access between the out-of-band management processor (BMC/FSP) and the in-band host system architecture.\nPrivilege requirements for exploitation mandate that the attacker must first acquire service account or root-level access to the BMC/FSP. Network exposure depends on the management network configuration of the target BMC/FSP, though the vulnerability itself is triggered locally through the management subsystem.\nThe exploitation method relies on the ability of a privileged BMC/FSP user to bypass architectural boundaries and directly write arbitrary data to critical hardware control registers. Because hardware control registers dictate low-level processor states, memory management, and bus operations, arbitrary write capabilities at this layer grant the attacker absolute dominion over the host platform.\nThe step-by-step attack flow begins with the adversary authenticating to the BMC/FSP with service account or root credentials. Leveraging this privileged execution context, the attacker interacts with the BMC/FSP-to-host interface drivers or control utilities. The attacker crafts malicious payloads designed to target sensitive hardware control registers. Due to the lack of strict input sanitization and access validation on the interface, the arbitrary data is successfully committed to the hardware registers. Once the registers are manipulated, the attacker alters host system execution flow, disables security enforcement mechanisms, or directly modifies host memory structures.\nThe post-exploitation impact includes full system compromise. The attacker gains unfettered read and write access to all hosted partitions, enabling data exfiltration, persistent firmware implants, complete destruction of system availability, and evasion of standard host-based operating system security controls."
}