Description

Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the host firmware. An attacker with service access to the service processor can supply a carefully crafted command that could leak the contents of hardware registers that should be inaccessible to the service processor. Successful exploitation could result in limited confidentiality or availability impacts to the affected host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-08-19T19:17:12.633Z",
  "pubdate": "2026-08-19T19:17:12.633Z",
  "executiveSummary": "A host firmware vulnerability exists in Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80. The flaw resides within the host firmware interface, specifically concerning command handling originating from the service processor. An attacker possessing service-level access to the service processor can supply a carefully crafted command to bypass access control boundaries, resulting in the unauthorized disclosure of sensitive hardware register contents that should otherwise remain strictly inaccessible to the service processor component. Successful exploitation of this vulnerability directly impacts system security by compromising the confidentiality of internal hardware registers, and may additionally cause availability impacts to the affected host system. Exploitation requires prior authentication or physical/logical service access to the service processor interface, constraining the attack vector to actors with administrative or service-level privileges on the management subsystem.",
  "technicalDetails": "The vulnerability stems from improper input validation and insufficient privilege separation within the host firmware subsystem of the affected Power Systems Firmware versions. Specifically, Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 fail to adequately sanitize and restrict command strings processed by the host firmware when received from the service processor interface.\nThe attack vector requires the threat actor to have obtained prior service access to the service processor. From this privileged management vantage point, the attacker constructs and transmits a maliciously crafted command payload targeting the host firmware communication channel. Due to the absence of rigorous bounds checking and authorization enforcement on the receiving component, the crafted command is executed with elevated context or bypasses internal access control lists (ACLs) governing hardware state inspection.\nUpon processing the malformed command, the vulnerable host firmware component improperly exposes the contents of internal hardware registers that are architecturally designated as restricted and inaccessible to the service processor. The exfiltrated register contents may contain sensitive architectural states, cryptographic material, or internal control data. Furthermore, the anomalous handling of the crafted command can induce instability within the host firmware execution flow, thereby precipitating localized denial-of-service conditions or availability degradation of the host system.\nThe architectural interaction between the service processor and the host firmware forms the core vulnerable component. The lack of strict cryptographic verification, mutual authentication, or command parameter validation across the internal management bus permits the injection and execution of unauthorized control operations. Post-exploitation impact is characterized by unauthorized information disclosure regarding low-level hardware components and potential host system availability degradation."
}