CVE-2022-22374

The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host

Medium · published March 24, 2022

CVSS v3.0
6.5
EPSS
1%
Percentile
62.5
In the wild
Unconfirmed
What it is

⚠️ A firmware downgrade attack is lurking in the shadows of IBM Power 9 devices! This vulnerability could hinder operation and affect your host like a power outage during peak usage! Think of it like a hotel where guests can sneak back to outdated rooms, complete with broken amenities — not a pleasant experience for anyone involved! Here, your firmware can be rolled back to a less stable version, impacting the performance of your system. If an attacker successfully downgrades the firmware, it could lead to instability and degradation of the host's operations, much like a malfunctioning elevator causing chaos in a busy building. While it’s not currently being exploited, the potential for disruption remains a concern.

Put simply

Think of it like a hotel where guests can sneak back to outdated rooms, complete with broken amenities — not a pleasant experience for anyone involved! Here, your firmware can be rolled back to a less stable version, impacting the performance of your system. This vulnerability allows for unauthorized firmware downgrades on specific IBM Power 9 models, which could compromise the device's functionality and security. Affected versions have not been specified, but the risk is tangible if not managed properly.

What to do

If an attacker successfully downgrades the firmware, it could lead to instability and degradation of the host's operations, much like a malfunctioning elevator causing chaos in a busy building. While it’s not currently being exploited, the potential for disruption remains a concern. To safeguard your systems, ensure you're running the latest firmware versions and consider implementing strict access controls to prevent unauthorized updates. Regularly review your device configurations for potential vulnerabilities. You’ve got this! With a few proactive steps, you can keep your systems running smoothly and securely! 🛡️

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/A:H/C:N/AV:N/I:L/AC:H/S:U/UI:N/PR:N/E:U/RC:C/RL:O
CVSS v4.0
Not supplied
EPSS
0.01001 · 62.5th percentile
Published
2022-03-24T17:20Z
EPSS history
Timeline
  • 24 MAR 17:20Z
    The BMC (IBM Power 9 AC922 OP910, OP920, OP930, and OP940) may be subject to a firmware downgrade attack which may affect its ability to operate its host
    cvelistv5