CVE-2026-7254 - Vulnerability Details - OpenCVE

IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Openbmc

Configuration 1 [-]

cpe:2.3:o:ibm:openbmc:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7272993

History

Tue, 02 Jun 2026 16:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:o:ibm:openbmc::::::::

Wed, 27 May 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 27 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
Title		Open BMC Denial of Service
First Time appeared		Ibm Ibm openbmc
Weaknesses		CWE-1284
CPEs		cpe:2.3:a:ibm:openbmc:fw1110.00.0:::::::* cpe:2.3:a:ibm:openbmc:fw1110.00:::::::* cpe:2.3:a:ibm:openbmc:fw1110.11.0:::::::* cpe:2.3:a:ibm:openbmc:fw1110.11:::::::*
Vendors & Products		Ibm Ibm openbmc
References		https://www.ibm.com/support/pages/node/7272993

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2026-05-27T13:12:06.648Z

Updated: 2026-05-27T14:48:48.502Z

Reserved: 2026-04-27T23:05:58.869Z

Link: CVE-2026-7254

Vulnrichment

Updated: 2026-05-27T14:44:13.112Z

NVD

Status : Analyzed

Published: 2026-05-27T14:17:35.173

Modified: 2026-06-02T15:45:26.857

Link: CVE-2026-7254

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7254", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2026-04-27T23:05:58.869Z", "datePublished": "2026-05-27T13:12:06.648Z", "dateUpdated": "2026-05-27T14:48:48.502Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-05-27T13:13:28.863Z"}, "title": "Open BMC Denial of Service", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input", "type": "CWE"}]}], "affected": [{"vendor": "IBM", "product": "OPENBMC", "versions": [{"status": "affected", "version": "FW1110.00", "lessThanOrEqual": "FW1110.11", "versionType": "semver"}], "cpes": ["cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.11.0:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "IBM OPENBMC FW1110.00 through FW1110.11\u00a0is vulnerable to denial of service attacks by unauthenticated network users.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>IBM OPENBMC FW1110.00 through FW1110.11 <span>is vulnerable to denial of service attacks by unauthenticated network users.</span></p><div></div><br>"}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7272993", "tags": ["vendor-advisory", "patch"]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.<br>Power 11<br>1) IBM Power System S1122 (9824-22A)<br>2) IBM Power System S1124 (9824-42A)<br>3) IBM Power System S1122s (9824-22B)<br>4) IBM Power System S1114 (9824-41B)<br>5) IBM Power System L1122 (9856-22H)<br>6) IBM Power System L1124 (9856-42H)<br>7) IBM Power System E1150 (9043-MRU)</p><p>The images mentioned above can be located at IBM Fix Central : <a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/support/fixcentral/</a></p>"}]}], "x_generator": {"engine": "ibm-cvegen"}, "workarounds": [{"lang": "en", "value": "Protect access to the BMC's network interface.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Protect access to the BMC's network interface.</p>"}]}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T14:48:19.046200Z", "id": "CVE-2026-7254", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:48:48.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-7254", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T14:48:19.046200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T14:44:13.112Z"}}], "cna": {"title": "Open BMC Denial of Service", "affected": [{"cpes": ["cpe:2.3:a:ibm:openbmc:fw1110.00:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.00.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.11:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:openbmc:fw1110.11.0:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "OPENBMC", "versions": [{"status": "affected", "version": "FW1110.00", "versionType": "semver", "lessThanOrEqual": "FW1110.11"}]}], "solutions": [{"lang": "en", "value": "Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.\nPower 11\n1) IBM Power System S1122 (9824-22A)\n2) IBM Power System S1124 (9824-42A)\n3) IBM Power System S1122s (9824-22B)\n4) IBM Power System S1114 (9824-41B)\n5) IBM Power System L1122 (9856-22H)\n6) IBM Power System L1124 (9856-42H)\n7) IBM Power System E1150 (9043-MRU)\n\n\n\nThe images mentioned above can be located at IBM Fix Central : https://www.ibm.com/support/fixcentral/", "supportingMedia": [{"type": "text/html", "value": "<p>Customers with the products below should install FW1110.20(1110_130) or newer to remediate this vulnerability.<br>Power 11<br>1) IBM Power System S1122 (9824-22A)<br>2) IBM Power System S1124 (9824-42A)<br>3) IBM Power System S1122s (9824-22B)<br>4) IBM Power System S1114 (9824-41B)<br>5) IBM Power System L1122 (9856-22H)<br>6) IBM Power System L1124 (9856-42H)<br>7) IBM Power System E1150 (9043-MRU)</p><p>The images mentioned above can be located at IBM Fix Central : <a href=\"https://www.ibm.com/support/fixcentral/\" rel=\"noopener noreferrer nofollow\">https://www.ibm.com/support/fixcentral/</a></p>", "base64": false}]}], "references": [{"url": "https://www.ibm.com/support/pages/node/7272993", "tags": ["vendor-advisory", "patch"]}], "workarounds": [{"lang": "en", "value": "Protect access to the BMC's network interface.", "supportingMedia": [{"type": "text/html", "value": "<p>Protect access to the BMC's network interface.</p>", "base64": false}]}], "x_generator": {"engine": "ibm-cvegen"}, "descriptions": [{"lang": "en", "value": "IBM OPENBMC FW1110.00 through FW1110.11\u00a0is vulnerable to denial of service attacks by unauthenticated network users.", "supportingMedia": [{"type": "text/html", "value": "<p>IBM OPENBMC FW1110.00 through FW1110.11 <span>is vulnerable to denial of service attacks by unauthenticated network users.</span></p><div></div><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper Validation of Specified Quantity in Input"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2026-05-27T13:13:28.863Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7254", "state": "PUBLISHED", "dateUpdated": "2026-05-27T14:48:48.502Z", "dateReserved": "2026-04-27T23:05:58.869Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2026-05-27T13:12:06.648Z", "assignerShortName": "ibm"}, "dataVersion": "5.2"}