Description

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An attacker who can lure a logged-in ASMI administrator to visit a crafted web page can, under specific conditions, silently perform administrative actions on the FSP on behalf of that administrator, resulting in a confidentiality, integrity, and availability impact to the managed system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.3",
  "pubDate": "2026-08-19T19:17:12.247Z",
  "pubdate": "2026-08-19T19:17:12.247Z",
  "executiveSummary": "A security vulnerability affecting the Advanced System Management Interface (ASMI) web interface in IBM Power Systems firmware allows an unauthorized third party to execute unauthorized administrative actions.\nThe vulnerability impacts IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nSuccessful exploitation results in severe implications for confidentiality, integrity, and availability of the managed system.\nThe attack vector requires a social engineering component, specifically requiring an authenticated ASMI administrator to visit a crafted web page controlled by the attacker.\nUnder these specific conditions, the malicious page can silently perform administrative actions directly on the Flexible Service Processor (FSP) leveraging the victim's active session and privileges.",
  "technicalDetails": "The vulnerability resides within the ASMI web interface component of the affected IBM Power Systems firmware versions.\nThe root cause stems from insufficient validation of incoming requests within the web application, allowing unauthorized command execution via cross-site request forgery mechanisms.\nThe affected versions include FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2.\nExploitation requires network exposure of the ASMI web interface and relies on the attacker luring a currently logged-in ASMI administrator to a maliciously crafted web page.\nThe attack flow proceeds as follows: First, the target administrator establishes an authenticated session with the ASMI web interface on the FSP. Second, the administrator navigates to or is lured to an attacker-controlled web page while the ASMI session remains active in the browser. Third, the crafted web page silently issues automated HTTP requests or form submissions destined for the ASMI web interface on the FSP. Fourth, because the browser automatically includes valid session cookies or authentication tokens associated with the active ASMI session, the FSP processes the incoming requests as legitimate administrative commands.\nPost-exploitation impact includes unauthorized execution of administrative actions on the FSP on behalf of the administrator, leading to full compromise of confidentiality, integrity, and availability of the managed system."
}