What’s Vulnerable › Vulnerabilities

CVE-2012-4856

• Severity: high (CVSS 7.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2012-12-20 · updated 2026-06-16
• Weakness: CWE-255

Description

The Service Processor in the IBM Power 5 91##-### and 940#-### before SF240_418_382 does not ensure that firewall code is executed, which allows remote attackers to execute arbitrary code via unspecified vectors.

Affected products

• IBM Power 5: 9110-51a, 9110-510, 9111-285, 9111-520, 9113-550, 9115-505 (+13)
• IBM Power 5 System Firmware: through sf240_418; sf240_201_201, sf240_202_201, sf240_219_201, sf240_222_201, sf240_233_201, sf240_258_201 (+14)

References

• http://aix.software.ibm.com/aix/efixes/security/squadrons_advisory.asc
• http://www.kb.cert.org/vuls/id/194604
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79736
• http://aix.software.ibm.com/aix/efixes/security/squadrons_advisory.asc
• http://www.kb.cert.org/vuls/id/194604
• https://exchange.xforce.ibmcloud.com/vulnerabilities/79736

Get alerted when CVE-2012-4856 or the next vulnerability affects your stack