Read the docs
TI-2021-16398 Aliases CVE-2021-38960GHSA-prm8-2hvv-hwfr

Information disclosure in IBM OPENBMC

Priority LOW 35CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.

Why it matters now

EPSS 0.01063 64th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMOPENBMCOP920; OP930; OP940—No fix listedCNA
IBMHMCOP940—No fix listedCNA
  • OPENBMC VendorIBM Affected OP920; OP930; OP940 Fixed in — No fix listed CNA
  • HMC VendorIBM Affected OP940 Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op920:*:*:*:*:*:*:*op920VulnerableIBM
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op930:*:*:*:*:*:*:*op930VulnerableIBM
cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op940:*:*:*:*:*:*:*op940VulnerableIBM
cpe:2.3:h:ibm:power_system_ac922_\(8335-gtx\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op920:*:*:*:*:*:*:*op920VulnerableIBM
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op930:*:*:*:*:*:*:*op930VulnerableIBM
cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op940:*:*:*:*:*:*:*op940VulnerableIBM
cpe:2.3:h:ibm:power_system_ac922_\(8335-gth\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:power_hardware_management_console_\(7063-cr2\)_firmware:op940:*:*:*:*:*:*:*op940VulnerableIBM
cpe:2.3:h:ibm:power_hardware_management_console_\(7063-cr2\):-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op920:*:*:*:*:*:*:* Versions op920 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op930:*:*:*:*:*:*:* Versions op930 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gtx\)_firmware:op940:*:*:*:*:*:*:* Versions op940 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_ac922_\(8335-gtx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op920:*:*:*:*:*:*:* Versions op920 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op930:*:*:*:*:*:*:* Versions op930 Vulnerable ·IBM
  • cpe:2.3:o:ibm:power_system_ac922_\(8335-gth\)_firmware:op940:*:*:*:*:*:*:* Versions op940 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_system_ac922_\(8335-gth\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:power_hardware_management_console_\(7063-cr2\)_firmware:op940:*:*:*:*:*:*:* Versions op940 Vulnerable ·IBM
  • cpe:2.3:h:ibm:power_hardware_management_console_\(7063-cr2\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-38960
  2. 2026-10-03 Alias added: GHSA-prm8-2hvv-hwfr

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences