Read the docs
TI-2016-00202 Aliases CVE-2016-0230GHSA-pxf8-85w5-w34j

IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3…

Priority LOW 30CWE-264Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

IBM Power Hardware Management Console (HMC) 7.3 through 7.3.0 SP7, 7.9 through 7.9.0 SP3, 8.1 through 8.1.0 SP3, 8.2 through 8.2.0 SP2, 8.3 through 8.3.0 SP2, 8.4 through 8.4.0 SP1, and 8.5.0 allows physically proximate attackers to obtain root access via unspecified vectors.

Why it matters now

EPSS 0.00436 38th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:ibm:hardware_management_console:7.9.0:-:*:*:*:*:*:*7.9.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp1:*:*:*:*:*:*7.9.0 sp1VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp2:*:*:*:*:*:*7.9.0 sp2VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp3:*:*:*:*:*:*7.9.0 sp3VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.1.0:-:*:*:*:*:*:*8.1.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp1:*:*:*:*:*:*8.1.0 sp1VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp2:*:*:*:*:*:*8.1.0 sp2VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp3:*:*:*:*:*:*8.1.0 sp3VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.2.0:-:*:*:*:*:*:*8.2.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.2.0:sp1:*:*:*:*:*:*8.2.0 sp1VulnerableIBM
  • cpe:2.3:a:ibm:hardware_management_console:7.9.0:-:*:*:*:*:*:* Versions 7.9.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp1:*:*:*:*:*:* Versions 7.9.0 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp2:*:*:*:*:*:* Versions 7.9.0 sp2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.9.0:sp3:*:*:*:*:*:* Versions 7.9.0 sp3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.1.0:-:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp1:*:*:*:*:*:* Versions 8.1.0 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp2:*:*:*:*:*:* Versions 8.1.0 sp2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.1.0:sp3:*:*:*:*:*:* Versions 8.1.0 sp3 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.2.0:-:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.2.0:sp1:*:*:*:*:*:* Versions 8.2.0 sp1 Vulnerable ·IBM
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:ibm:hardware_management_console:8.2.0:sp2:*:*:*:*:*:*8.2.0 sp2VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.3.0:-:*:*:*:*:*:*8.3.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.3.0:sp1:*:*:*:*:*:*8.3.0 sp1VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.3.0:sp2:*:*:*:*:*:*8.3.0 sp2VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.3.0:-:*:*:*:*:*:*7.3.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp1:*:*:*:*:*:*7.3.0 sp1VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp4:*:*:*:*:*:*7.3.0 sp4VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp5:*:*:*:*:*:*7.3.0 sp5VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp7:*:*:*:*:*:*7.3.0 sp7VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.4.0:-:*:*:*:*:*:*8.4.0VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.4.0:sp1:*:*:*:*:*:*8.4.0 sp1VulnerableIBM
cpe:2.3:a:ibm:hardware_management_console:8.5.0:*:*:*:*:*:*:*8.5.0VulnerableIBM
  • cpe:2.3:a:ibm:hardware_management_console:8.2.0:sp2:*:*:*:*:*:* Versions 8.2.0 sp2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.3.0:-:*:*:*:*:*:* Versions 8.3.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.3.0:sp1:*:*:*:*:*:* Versions 8.3.0 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.3.0:sp2:*:*:*:*:*:* Versions 8.3.0 sp2 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.3.0:-:*:*:*:*:*:* Versions 7.3.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp1:*:*:*:*:*:* Versions 7.3.0 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp4:*:*:*:*:*:* Versions 7.3.0 sp4 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp5:*:*:*:*:*:* Versions 7.3.0 sp5 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:7.3.0:sp7:*:*:*:*:*:* Versions 7.3.0 sp7 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.4.0:-:*:*:*:*:*:* Versions 8.4.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.4.0:sp1:*:*:*:*:*:* Versions 8.4.0 sp1 Vulnerable ·IBM
  • cpe:2.3:a:ibm:hardware_management_console:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-0230
  2. 2026-10-03 Alias added: GHSA-pxf8-85w5-w34j

References

Patch 1

Advisory 12

  • TI-2026-11016 This Power Hardware Management Console update is being released to address CVSS 3.1CRITICAL 9.8
  • TI-2009-00167 Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.2.0 SP1… CVSS 2.0HIGH 10.0
  • TI-2007-06000 Multiple unspecified vulnerabilities in IBM Hardware Management Console (HMC) 6 R1.3… CVSS 2.0HIGH 10.0
  • TI-2009-01718 Unspecified vulnerability in IBM Hardware Management Console (HMC) 7 release 3.4.0 SP2… CVSS 2.0HIGH 9.3
  • TI-2025-01695 IBM Hardware Management Console - Power Systems command execution CVSS 3.1CRITICAL 9.3
  • TI-2008-00467 Unspecified vulnerability in the Pegasus CIM Server in IBM Hardware Management Console… CVSS 2.0HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences