Listen to this Post
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact.
The vulnerability resides in the communication interface between the Baseboard Management Controller (BMC) or Flexible Service Processor (FSP) and the host POWER processor system. The BMC/FSP is a dedicated microcontroller that provides out-of-band management capabilities for IBM Power Systems, allowing administrators to monitor and control the system independently of the host operating system. Under normal operation, the BMC/FSP communicates with the host processor through a specialized interface that enforces strict privilege boundaries—the service processor should only have limited visibility into host processor state and should not be able to execute code on the host.
The flaw, identified as CWE-862 (Missing Authorization), stems from insufficient authorization checks within this interface. When a user with service account or root privileges on the BMC/FSP issues certain commands through the management interface, the host system does not properly validate whether the requesting entity is authorized to perform the requested operation on host processor resources. This missing authorization check effectively breaks the isolation between the management plane (BMC/FSP) and the host system’s trusted execution environment.
An attacker who has already obtained service account credentials or root access to the BMC/FSP—potentially through compromised management network credentials, default credentials, or other vulnerabilities—can leverage this missing authorization to send crafted commands across the BMC/FSP-host interface. The host system, failing to properly authorize these commands, executes them with full privileges on the host processor. This allows the attacker to read or modify host processor state, access host memory containing sensitive data from any hosted partition, and disrupt host operations.
The CVSS 3.1 vector string is CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, reflecting an 8.2 HIGH severity rating. The attack vector is local (AV:L), meaning the attacker must already have some level of access to the BMC/FSP. Attack complexity is low (AC:L), and high privileges (PR:H) are required—specifically service account or root access on the BMC/FSP. User interaction is not required (UI:N), and the scope is changed (S:C), meaning a vulnerability in one security domain (BMC/FSP) impacts resources in another (host system). The impact on confidentiality, integrity, and availability is all HIGH.
The vulnerability affects IBM Power Systems firmware versions FW1120.00, all FW1110.00 through FW1110.30, and all FW1060.00 through FW1060.80. This spans multiple Power System hardware generations including Power 10 and Power 11 systems.
DailyCVE Form:
Platform: IBM Power Systems
Version: FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80
Vulnerability: Missing Authorization (CWE-862)
Severity: HIGH (8.2 CVSS 3.1)
Date: 2026-08-19
Prediction: 2026-09-15 (FW1110.31 / FW1120.01)
What Undercode Say:
The authorization bypass allows service processor-level access to escalate into full host system compromise. The key issue is the absence of proper privilege checks on the BMC/FSP-to-host interface—commands originating from the service processor are trusted implicitly by the host system. This trust relationship was designed for administrative convenience but becomes a security liability when the BMC/FSP itself is compromised. Given that the BMC/FSP runs its own operating system and network stack, it presents an attractive pivot point for attackers. Once an attacker achieves service account or root access on the BMC/FSP—whether through credential theft, default credentials, or another vulnerability—they can effectively own the entire physical host and all logical partitions (LPARs) running on it.
Analytics:
Check current firmware version on IBM Power System Via HMC (Hardware Management Console) lssyscfg -r sys -F name,firmware Via direct FSP/BMC access (service account) Connect to FSP via SSH ssh -p 22 admin@<fsp-ip> Once logged in, check firmware level cat /proc/version fspver Check if system is running vulnerable firmware Vulnerable: FW1120.00, FW1110.00-FW1110.30, FW1060.00-FW1060.80 Fixed: FW1110.31, FW1120.01, FW1060.81 or newer Example exploit concept - crafting malicious command to host interface This is a conceptual demonstration; actual exploitation vectors are vendor-confidential The vulnerability lies in the BMC/FSP-host communication channel Commands sent from FSP to host are not properly authorized Identify host interface endpoint (example - varies by system) ls -la /dev/fsi /dev/scom Monitor FSP-host communication for unauthorized access attempts Audit logs on FSP cat /var/log/messages | grep -i "host" cat /var/log/audit/audit.log | grep -i "unauthorized" Check for unexpected host state changes (indicative of exploitation) From HMC, check partition state lssyscfg -r lpar -m <managed-system> -F name,state
Exploit: (Educational Purposes!)
The exploitation path requires prior compromise of the BMC/FSP with service account or root privileges:
1. Establish foothold on BMC/FSP: Gain service account or root access to the BMC/FSP through compromised credentials, default passwords, or exploiting another vulnerability in the management interface.
2. Identify host interface: The BMC/FSP communicates with the host processor via a dedicated hardware interface (e.g., FSI, SCOM, or PSI links). Identify the appropriate device nodes or communication channels.
3. Craft unauthorized commands: Construct commands that manipulate host processor state—this could include reading host memory, modifying processor registers, or injecting code into host execution context.
4. Execute with elevated privileges: Send the crafted commands across the BMC/FSP-host interface. Due to the missing authorization check (CWE-862), the host system does not verify that the BMC/FSP has proper authorization to perform the requested operation.
5. Full host compromise: Once the commands execute on the host, the attacker gains full control over the host system and all hosted partitions, enabling data exfiltration, malware installation, or denial of service.
Protection:
- Upgrade to fixed firmware versions: FW1110.31 (1110_134/155), FW1120.01 (1120_167/190), or FW1060.81 (1060_184/191) or newer
- Restrict and audit access to BMC/FSP management interfaces; enforce strong authentication and least-privilege access
- Change all default credentials on BMC/FSP immediately upon deployment
- Isolate BMC/FSP management networks from untrusted networks; use dedicated management VLANs with strict firewall rules
- Monitor BMC/FSP access logs for unauthorized login attempts or unusual command patterns
- Implement multi-factor authentication (MFA) for service account access to BMC/FSP
- Regularly audit service account usage and rotate credentials periodically
Impact:
Successful exploitation allows an attacker with service account or root access to the BMC/FSP to execute arbitrary code on the host system, granting full control over the host processor and all hosted logical partitions (LPARs). This results in complete compromise of confidentiality (sensitive data from all partitions can be read), integrity (host and partition data can be modified or corrupted), and availability (host and partitions can be disrupted or taken offline). The scope is changed, meaning the impact extends beyond the BMC/FSP to the entire managed system. Given that IBM Power Systems are commonly used in enterprise data centers and cloud infrastructure, this vulnerability poses significant risk to critical workloads, virtualized environments, and sensitive data stored on affected systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
