IBM Power Systems Firmware versions FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 contain a CSRF vulnerability in the ASMI web interface. The flaw allows an attacker to perform administrative actions on the Flexible Service Processor (FSP) by exploiting the trust of a logged-in administrator who visits a crafted web page. The vulnerability has a CVSS 3.1 base score of 8.3, indicating high severity with network attack vector, low attack complexity, no privileges required, but requires user interaction. The impact includes potential confidentiality loss, high integrity compromise, and high availability disruption.

Successful exploitation can lead to unauthorized administrative actions on the FSP, compromising the confidentiality, integrity, and availability of the managed IBM Power Systems. This could allow attackers to manipulate system settings or disrupt system operations without direct access.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, administrators should avoid visiting untrusted web pages while logged into the ASMI interface and consider additional network-level protections to restrict access to the ASMI web interface.