Paper/Archive/CVE-2021-20487

CVE-2021-20487

IBM Power 9 Systems — IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware…

EPSS 0.7%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 52.4.524 × 2010.5 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.

Affected

ProductAffectedFixed inSource

Power 9 SystemsFW930–CNA

Power 9 SystemsFW940–CNA

Power 9 SystemsFW941–CNA

Power 9 SystemsOP940–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

ibm (CNA)8.0CVSS:3.0/AV:N/UI:N/I:H/AC:H/PR:H/S:C/A:H/C:H/E:U/RL:O/RC:C

References

refibm.com/support/pages/node/6455911 refexchange.xforce.ibmcloud.com/vulnerabilities/197730