Skip to content
Fencer Intel
medium 6.4

CVE-2018-1992 json

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware imag…

published 2019-03-21 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-12571

cvss
6.4
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits
0
none known

Summary

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.

Patch / fix

  • ibm power_system_s922_(9009-22a)_firmware fw910.10
  • ibm power_system_h922_(9223-22h)_firmware fw910.10
  • ibm power_system_s914_(9009-41a)_firmware fw910.10
  • ibm power_system_s924_(9009-42a)_firmware fw910.10
  • ibm power_system_h924_(9223-42h)_firmware fw910.10
  • ibm power_system_l922_(9008-22l)_firmware fw910.10
  • ibm power_system_ac922_(8335-gtg)_firmware op910.30
  • ibm power_system_ac922_(8335-gth)_firmware op920.10
  • ibm power_system_ac922_(8335-gtx)_firmware op920.10
  • ibm power_system_lc921_(9006-12p)_firmware op920.10
  • ibm power_system_lc922_(9006-22p)_firmware op920.10

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 6.4 CVSS:3.0/PR:H/AV:L/S:U/I:H/UI:N/AC:H/A:H/C:H/RC:C/E:U/RL:O
CNA 3.0 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.9 AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

  • IBM Power 9 Systems

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.