IBM PowerVM Hypervisor firmware versions FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 reproduce persistent key seeds that produce AES keys with reduced strength. The weakness, identified as CWE‑331, permits an attacker with privileged access to the service processor or Hypervisor Management Console (HMC) to derive the encryption key and read or modify encrypted configuration data, such as partition settings, the Platform Keystore, and virtual TPM information, thereby undermining data confidentiality and integrity.

The advisory lists multiple IBM Power System models on Power 9, 10, and 11 platforms. Affected devices include S922, H922, S914, S924, H924, E950, E980, S1022, S1024, S1022s, S1014, L1022, L1024, E1050, S1012, S1122, S1124, S1114, L1122, L1124, E1150, S1112, and others. Firmware versions FW1110.x, FW1060.x, and FW950.x are impacted for these systems.

With a CVSS score of 5.1, the vulnerability carries moderate severity. No EPSS score is reported and the issue is not listed in the CISA KEV catalog. Exploitation requires high‑level access to the HMC or service processor; it is not exploitable remotely. Because the weakened keys enable decryption of critical configuration and security data, the risk to confidentiality is significant even though exploitation probability remains uncertain.