IBM Power System AC922 (8335-Gtg) Firmware vulnerabilities

4 CVEs affecting IBM Power System AC922 (8335-Gtg) Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-22488, published 2022-12-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-38961, published 2021-12-27. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading…
CVE-2022-22488, published 2022-12-12. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.
CVE-2021-29891, published 2022-08-22. Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM OPENBMC OP910 and OP940 could allow a privileged user to upload an improper site identity certificate that may cause it to lose network services. IBM X-Force ID: 207221.
CVE-2018-1992, published 2019-03-21. Medium severity, CVSS 6.4. EPSS: 0.4% chance of exploitation in the next 30 days. The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware…