The vulnerability resides in IBM Power Systems firmware for the Virtualization Management Interface and allows a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management. The flaw is a classic example of CWE‑772, where failing to release resources leads to a depletion of available connections, making the management interface unavailable to legitimate users and potentially disrupting dependent services. The impact is purely availability; the attacker does not gain confidentiality or integrity privileges beyond what is required for authentication.

The flaw affects IBM Virtualization Management Interface firmware versions FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81. Affected hardware includes Power 11 systems such as the S1122 (9824‑22A), S1124 (9824‑42A), S1122s (9824‑22B), S1114 (9824‑41B), L1122 (9856‑22H), L1124 (9856‑42H), E1150 (9043‑MRU), and S1112 (9242‑21B, 9242‑21T); and Power 10 systems such as the S1022 (9105‑22A), S1024 (9105‑42A), S1022s (9105‑22B), S1014 (9105‑41B), L1022 (9786‑22H), L1024 (9786‑42H), E1050 (9043‑MRX), and S1012 (9028‑21B).

The CVSS score of 4.5 indicates a moderate severity primarily focused on availability. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation has been confirmed yet. Nonetheless, since the attack requires remote authenticated access to the management interface, an attacker with credentials could trigger the denial of service. The likelihood of successful exploitation is contingent upon the presence of privileged credentials and exposure of the interface to a potentially adversarial network. Administrators should therefore consider the risk moderate but actionable, and proceed with remediation to mitigate potential downtime.