9.1

CVE-2021-20487

IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.

Data is provided by the National Vulnerability Database (NVD)
Ibm ≫ Power9 System Firmware Version >= fw930.00 < fw930.30
   Ibm ≫ 9008-22l Version-
   Ibm ≫ 9009-22a Version-
   Ibm ≫ 9009-41a Version-
   Ibm ≫ 9009-42a Version-
   Ibm ≫ 9040-mr9 Version-
   Ibm ≫ 9080-m9s Version-
   Ibm ≫ 9223-22h Version-
   Ibm ≫ 9223-42h Version-
Ibm ≫ Power9 System Firmware Version >= fw940.00 < fw940.20
   Ibm ≫ 9008-22l Version-
   Ibm ≫ 9009-22a Version-
   Ibm ≫ 9009-41a Version-
   Ibm ≫ 9009-42a Version-
   Ibm ≫ 9040-mr9 Version-
   Ibm ≫ 9080-m9s Version-
   Ibm ≫ 9223-22h Version-
   Ibm ≫ 9223-42h Version-
Ibm ≫ Power9 System Firmware Version < fw950.00
   Ibm ≫ 9009-22g Version-
   Ibm ≫ 9009-41g Version-
   Ibm ≫ 9009-42g Version-
   Ibm ≫ 9223-22s Version-
   Ibm ≫ 9223-42s Version-
Ibm ≫ Scale-out Lc System Firmware Version < op940.20
   Ibm ≫ 8335-gth Version-
   Ibm ≫ 8335-gtx Version-
   Ibm ≫ 9183-22x Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.13% 0.289
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvd@nist.gov 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
psirt@us.ibm.com 8 1.3 6
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.