Description
IBM PowerVM Hypervisor Platform KeyStore (PKS) and virtual TPM FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H2 use persistent storage key seeds that result in an AES key with reduced strength. An attacker with access to the service processor or HMC could exploit this weakness to derive the encryption key and access the data.
Affected products
ibm: power system s1122 \(9824-22a\) firmware; ibm: power system s1122 \(9824-22a\); ibm: power system s1124 \(9824-42a\) firmware; ibm: power system s1124 \(9824-42a\); ibm: power system s1122s \(9824-22b\) firmware; ibm: power system s1122s \(9824-22b\); ibm: power system s1114 \(9824-41b\) firmware; ibm: power system s1114 \(9824-41b\); ibm: power system l1122 \(9856-22h\) firmware; ibm: power system l1122 \(9856-22h\); ibm: power system l1124 \(9856-42h\) firmware; ibm: power system l1124 \(9856-42h\); ibm: power system e1150 \(9043-mru\) firmware; ibm: power system e1150 \(9043-mru\); ibm: power system s1112 \(9242-21b\) firmware
References1
- www.ibm.com/support/pages/node/7283890 Vendor Advisory
Metrics
- CVSS 3.1
-
6.2
MEDIUM
Score source: NVD
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N - EPSS — exploit probability
- 0% percentile: 1 · as of 10 November 2026
- CWE
- CWE-331
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.