CRITICAL🇵🇱 Wersja polska

CVE-2024-45656

CVSS 9.8v3.1pub. 2024-10-29upd. 2025-12-03

IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.

🤖 AI Analysis
How it works

FSP (Flexible Service Processor) is a dedicated service processor in IBM Power servers, responsible for low-level hardware management. In vulnerable firmware versions, static credentials are hardcoded and are not uniquely generated for each device. An attacker with network access to the FSP interface can use these fixed credentials to authenticate and gain service privileges without knowledge of passwords configured by the administrator.

Impact

An attacker can gain privileged service access to the FSP processor, which potentially allows full control over server hardware management, including manipulation of hardware configuration, reading of sensitive data, and disruption of system availability.

Mitigation & patch

Apply patches available from the manufacturer according to the references (https://www.ibm.com/support/pages/node/7174183). Additionally, it is recommended to restrict network access to FSP interfaces exclusively to trusted management networks and implement network segmentation to prevent unauthorized access to these interfaces.

Who is affected

IBM Flexible Service Processor (FSP) in firmware versions: FW860.00–FW860.B3, FW950.00–FW950.C0, FW1030.00–FW1030.61, FW1050.00–FW1050.21, and FW1060.00–FW1060.10. Affects IBM Power System E1080 (9080-HEX) and IBM Power System L922 (9008-22L) servers.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • IBM Ess 5000 \(5105 22e\)

    HW
    Ibm
    wszystkie wersje

  • IBM Ess 5000 \(5105 22e\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System E1080 \(9080 Hex\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E1080 \(9080 Hex\) Firmware

    OS
    Ibm
    FW1030.00 – FW1030.61FW1060.00 – FW1060.10FW1050.00 – FW1050.21

  • IBM Power System E850 \(8408 E8e\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E850 \(8408 E8e\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E850c \(8408 44e\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E850c \(8408 44e\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E870 \(9119 Mme\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E870 \(9119 Mme\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E870c \(9080 Mme\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E870c \(9080 Mme\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E880 \(9119 Mhe\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E880 \(9119 Mhe\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E880c \(9080 Mhe\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E880c \(9080 Mhe\) Firmware

    OS
    Ibm
    FW860.00 – FW860.B3

  • IBM Power System E950 \(9040 Mr9\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E950 \(9040 Mr9\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System E980 \(9080 M9s\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System E980 \(9080 M9s\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System H922 \(9223 22h\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System H922 \(9223 22h\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System H922 \(9223 22s\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System H922 \(9223 22s\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System H924 \(9223 42h\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System H924 \(9223 42h\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System H924 \(9223 42s\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System H924 \(9223 42s\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0

  • IBM Power System L922 \(9008 22l\)

    HW
    Ibm
    wszystkie wersje

  • IBM Power System L922 \(9008 22l\) Firmware

    OS
    Ibm
    FW950.00 – FW950.C0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2025-36035MEDIUM6.7ten sam produkt

IBM PowerVM Hypervisor FW950.00 through FW950.E0, FW1050.00 through FW1050.50, and FW1060.00 through FW1060.40...

CVE-2018-1992MEDIUM6.4ten sam produkt

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating t...

CVE-2022-47986CRITICAL9.8⚠ KEVten sam vendor

IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on t...

CVE-2020-4427CRITICAL9.8⚠ KEVten sam vendor

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 could allow a remote attacker to bypass sec...

CVE-2020-4428CRITICAL9.1⚠ KEVten sam vendor

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute ar...