The vulnerability stems from improper handling of uninitialized resources within IBM Power Systems firmware, allowing a remote attacker to trigger a denial of service. When the flaw is exercised, the Baseboard Management Controller (BMC) can become unresponsive or require a reboot, interrupting management and control functions. This weakness is classified as CWE-908, indicating a failure to protect against the use of uninitialized data, which directly undermines reliability and availability.

Affected are IBM Power System firmware versions FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82. The firmware impacts a range of hardware platforms, including Power 11 models S1122, S1124, S1122s, S1114, L1122, L1124, E1150, S1112; Power 10 models S1022, S1024, S1022s, S1014, L1022, L1024, E1050, S1012; OpenPower 9 AC922 variants; and the IBM Power Hardware Management Console 7063-CR2. These systems all use the aforementioned firmware builds and are therefore susceptible to the denial‑of‑service condition.

The CVSS score of 6.5 indicates moderate severity, and with no EPSS availability or recent exploitation evidence the overall risk is moderate. The flaw is exploitable from a remote network where the attacker can reach the BMC interface, which means that any exposed or unsecured BMC port provides a viable attack vector. The vulnerability is not listed in the CISA KEV catalog, but the lack of a firewall or private network on the BMC makes the risk higher in environments with public or shared BMC access.