PT-2024-7403 · Ibm · Ibm Flexible Service Processor

Published 2024-10-25 · Updated 2024-11-05 · CVE-2024-45656

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM Flexible Service Processor (FSP) versions FW860.00 through FW860.B3 IBM Flexible Service Processor (FSP) versions FW950.00 through FW950.C0 IBM Flexible Service Processor (FSP) versions FW1030.00 through FW1030.61 IBM Flexible Service Processor (FSP) versions FW1050.00 through FW1050.21 IBM Flexible Service Processor (FSP) versions FW1060.00 through FW1060.10

Description: The issue is related to the use of static credentials in the IBM Flexible Service Processor (FSP) firmware, which may allow network users to gain service privileges to the FSP. This could potentially lead to unauthorized access and full control over affected systems. The vulnerability is considered critical and may allow attackers to steal confidential data, disrupt operations, and deliver malicious software.

Recommendations: For IBM Flexible Service Processor (FSP) versions FW860.00 through FW860.B3, update the firmware to a version that is not affected by the static credentials issue. For IBM Flexible Service Processor (FSP) versions FW950.00 through FW950.C0, update the firmware to a version that is not affected by the static credentials issue. For IBM Flexible Service Processor (FSP) versions FW1030.00 through FW1030.61, update the firmware to a version that is not affected by the static credentials issue. For IBM Flexible Service Processor (FSP) versions FW1050.00 through FW1050.21, update the firmware to a version that is not affected by the static credentials issue. For IBM Flexible Service Processor (FSP) versions FW1060.00 through FW1060.10, update the firmware to a version that is not affected by the static credentials issue. As a temporary workaround, consider restricting access to the FSP until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-08777

CVE-2024-45656

Affected Products

Ibm Flexible Service Processor

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-45656 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45656 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08777 · Security Note
• https://ibm.com/support/pages/node/7174183 · Vendor Advisory
• https://twitter.com/Brandefense/status/1853729346696929318 · Twitter Post
• https://t.me/cvenotify/99824 · Telegram Post
• https://twitter.com/fletch_ai/status/1851881990276157859 · Twitter Post
• https://t.me/pentestingnews/52763 · Telegram Post
• https://t.me/true_secator/6378 · Telegram Post
• https://twitter.com/CCBalert/status/1852008950889127962 · Twitter Post
• https://t.me/latest_high_impact_cve/1410 · Telegram Post
• https://ibm.com/support/pages/security-bulletin-power-system-update-being-released-address-cve-2024-45656 · Note