CVE-2024-45656
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.45% probability · 38th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- ibm/power system e1080 \(9080-hex\) firmware · ibm/power system l922 \(9008-22l\) firmware · ibm/power system s922 \(9009-22a\) firmware · ibm/power system s922 \(9009-22g\) firmware · ibm/power system h922 \(9223-22h\) firmware · ibm/power system h922 \(9223-22s\) firmware · ibm/power system s914 \(9009-41a\) firmware · ibm/power system s914 \(9009-41g\) firmware · ibm/power system s924 \(9009-42a\) firmware · ibm/power system s924 \(9009-42g\) firmware · ibm/power system h924 \(9223-42h\) firmware · ibm/power system h924 \(9223-42s\) firmware · ibm/power system e950 \(9040-mr9\) firmware · ibm/power system e980 \(9080-m9s\) firmware · ibm/ess 5000 \(5105-22e\) firmware · ibm/power system s812 \(8284-21a\) firmware · ibm/power system s822 \(8284-22a\) firmware · ibm/power system s814 \(8286-41a\) firmware · ibm/power system s824 \(8286-42a\) firmware · ibm/power system s812l \(8247-21l\) firmware · +8 more
- Source
- psirt@us.ibm.com
References
- https://www.ibm.com/support/pages/node/7174183Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.