A critical security vulnerability has been discovered in IBM’s Flexible Service Processor (FSP), potentially allowing unauthorized network users to gain service privileges.

The vulnerability, CVE-2024-45656, affects multiple versions of IBM’s server firmware and has been assigned a high severity rating with a CVSS base score of 9.8.

The security flaw stems from static credentials in the IBM Flexible Service Processor. The static nature of these credentials could allow network users to gain service privileges to the FSP, potentially compromising the security of affected systems.

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

IBM Flexible Service Processor Vulnerability

The vulnerability impacts a wide range of IBM Power Systems, including:

Power10 servers running firmware versions FW1030.00 to FW1030.61, FW1050.00 to FW1050.21, and FW1060.00 to FW1060.10
Power9 servers with firmware versions FW950.00 to FW950.C0
Power8 servers using firmware versions FW860.00 to FW860.B3

It’s important to note that while only specific firmware versions are officially supported for each server generation, all prior firmware releases on the listed products are vulnerable.

IBM has released security updates to address this vulnerability and strongly recommends that customers install the following firmware versions as soon as possible:

For Power10 systems: FW1030.62(1030_082), FW1050.22(1050_063), FW1060.11(1060_065) or newer
For Power9 systems: FW950.C1(950_165) or newer
For Power8 systems: FW860.B4(860_246) or newer

These updates are available for a wide range of IBM Power Systems, including the E1080, L922, S922, H922, S914, S924, H924, E950, E980, and various S800 and E800 series models.

Given this vulnerability’s critical nature, organizations using affected IBM Power Systems must apply the security updates promptly.

The high CVSS score of 9.8 indicates that this vulnerability is easily exploitable and could have severe consequences if left unaddressed.

Currently, there are no known workarounds or mitigations for this vulnerability other than applying the provided firmware updates.

Organizations are advised to review their systems, identify affected devices, and plan to deploy the security patches immediately to minimize the risk of potential exploitation.

By addressing this vulnerability promptly, organizations can protect their IBM Power Systems from unauthorized access and maintain the integrity and security of their critical infrastructure.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

The post IBM Flexible Service Processor Vulnerability Lets Attackers Gain Service Privileges appeared first on Cyber Security News.