IBM Power Systems Firmware: unauthenticated ASMI web request crashes the service-processor interface

Impact

An unauthenticated attacker who can reach the management network can crash the ASMI web server, with possible memory corruption and an error log entry. IBM states hosted partitions are not affected and the web interface restarts on its own, so tenant workloads keep running — but repeated exploitation sustains a loss of ASMI access, which is your out-of-band control of the machine: remote power control, console, firmware update path, service diagnostics. Losing that on a fleet you cannot walk to is a real operational hole, and it bites hardest at exactly the moment you want to drain or power-cycle a wedged node. IBM rates it 7.6 with integrity and availability impact; the advisory says possible memory corruption and does not claim code execution.

Who can reach it

Anyone on the management network — CVSS AV:A, adjacent, PR:N, so no credentials and no user interaction. Affected levels are FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2. The exposure is bounded entirely by whether the management VLAN is reachable from tenant or general corporate networks.

What to do

Apply the IBM firmware update named in IBM support document 7283898 for your affected level. The advisory text given here does not state whether the update is concurrent or requires a platform IPL — read the IBM document before booking a window rather than assuming either. Until it is applied, the effective mitigation is network reach: ASMI should be on an isolated management VLAN with no path from tenant networks, which is worth verifying regardless of this CVE.

References