This vulnerability permits a remote attacker to cause a denial of service in IBM Power Systems firmware because input length is improperly validated. The flaw can be triggered by sending a deliberately malformed command to the Baseboard Management Controller (BMC). If successfully exploited, the affected device may become unresponsive, requiring a reboot or manual intervention, thereby disrupting availability of the host and any dependent services. The weakness falls under CWE-617.

IBM Power Systems employing OpenBMC firmware versions FW1060.00 through FW1060.81, OP940.00 through OP940.A2, OP910.00 through OP910.95, and OP940.00 through OP940.82 are affected. The firmware is used in Power 10 models such as the IBM Power System S1022, S1024, S1022s, S1014, L1022, L1024, E1050, and S1012, as well as the OpenPower 9 AC922 series. IBM Power Hardware Management Console devices running firmware until OP940.82 also remain vulnerable.

The vulnerability carries a CVSS score of 6.5, indicating medium severity, while the exploitation probability is not published and the issue is not listed in the CISA KEV database. The attack vector is remote, relying on network access to the BMC. Although the flaw can only induce a service interruption, it may still impact critical workloads and require downtime to restore service. No elevated privileges or persistence are required; the attack can be launched from an external host with network reach to the management interface.