A remote attacker can trigger a denial‑of‑service on IBM Power Systems by exploiting a lack of restriction on the use of computational resources within the BMC firmware. The flaw allows excessive use of CPU or memory resources, leading to service interruption and loss of availability. No confidentiality or integrity impact is described, and the weakness is classified as CWE-770, improper control of resource allocation.

Affected products include IBM Power System S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012, all running firmware versions FW1060.00 through FW1060.81. OpenPower AC922 systems running OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 are also impacted. The recommended remediation firmware updates are FW1060.82 (1060_199) or newer, OP940.A3 or newer, OP910.96 or newer, and OP940.83 or newer for the Power Hardware Management Console.

The CVSS score of 6.5 indicates medium severity, and there are no listed exploits or CISA KEV listing, suggesting limited public exploitation to date. However, the vulnerability is remotely reachable via the BMC’s network interface, meaning that systems exposed to the internet or having poor network segmentation are at higher risk. Protection of the BMC by isolating it on a private network or firewalling the interface offers additional defense, while the primary mitigation is to apply the listed firmware updates.