Read the docs
TI-2025-24766 Aliases CVE-2025-36238GHSA-wfpp-6h7f-cmmc

Power System Exposure of Sensitive System Information

Priority LOW 26CWE-497Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-497.

Summary

IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration privileges to obtain sensitive information from a Virtual TPM through a series of PowerVM service procedures.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMPowerVM HypervisorFW1110.00 – FW1110.03; FW1060.00 – FW1060.51; FW950.00 – FW950.F0—No fix listedCNA
  • PowerVM Hypervisor VendorIBM Affected FW1110.00 – FW1110.03; FW1060.00 – FW1060.51; FW950.00 – FW950.F0 Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:o:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:*fw950.00VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.10:*:*:*:*:*:*:*fw950.10VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.11:*:*:*:*:*:*:*fw950.11VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.20:*:*:*:*:*:*:*fw950.20VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.30:*:*:*:*:*:*:*fw950.30VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.40:*:*:*:*:*:*:*fw950.40VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.50:*:*:*:*:*:*:*fw950.50VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.60:*:*:*:*:*:*:*fw950.60VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.70:*:*:*:*:*:*:*fw950.70VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.71:*:*:*:*:*:*:*fw950.71VulnerableIBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.00:*:*:*:*:*:*:* Versions fw950.00 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.10:*:*:*:*:*:*:* Versions fw950.10 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.11:*:*:*:*:*:*:* Versions fw950.11 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.20:*:*:*:*:*:*:* Versions fw950.20 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.30:*:*:*:*:*:*:* Versions fw950.30 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.40:*:*:*:*:*:*:* Versions fw950.40 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.50:*:*:*:*:*:*:* Versions fw950.50 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.60:*:*:*:*:*:*:* Versions fw950.60 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.70:*:*:*:*:*:*:* Versions fw950.70 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.71:*:*:*:*:*:*:* Versions fw950.71 Vulnerable ·IBM
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:ibm:powervm_hypervisor:fw950.80:*:*:*:*:*:*:*fw950.80VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.90:*:*:*:*:*:*:*fw950.90VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.a0:*:*:*:*:*:*:*fw950.a0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.b0:*:*:*:*:*:*:*fw950.b0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.c0:*:*:*:*:*:*:*fw950.c0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.c1:*:*:*:*:*:*:*fw950.c1VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.c2:*:*:*:*:*:*:*fw950.c2VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.d0:*:*:*:*:*:*:*fw950.d0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.d1:*:*:*:*:*:*:*fw950.d1VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.e0:*:*:*:*:*:*:*fw950.e0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.e1:*:*:*:*:*:*:*fw950.e1VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw950.f0:*:*:*:*:*:*:*fw950.f0VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:*fw1060.00VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.10:*:*:*:*:*:*:*fw1060.10VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.12:*:*:*:*:*:*:*fw1060.12VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.20:*:*:*:*:*:*:*fw1060.20VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.21:*:*:*:*:*:*:*fw1060.21VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.40:*:*:*:*:*:*:*fw1060.40VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.41:*:*:*:*:*:*:*fw1060.41VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.50:*:*:*:*:*:*:*fw1060.50VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1060.51:*:*:*:*:*:*:*fw1060.51VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:*fw1110.00VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1110.01:*:*:*:*:*:*:*fw1110.01VulnerableIBM
cpe:2.3:o:ibm:powervm_hypervisor:fw1110.03:*:*:*:*:*:*:*fw1110.03VulnerableIBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.80:*:*:*:*:*:*:* Versions fw950.80 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.90:*:*:*:*:*:*:* Versions fw950.90 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.a0:*:*:*:*:*:*:* Versions fw950.a0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.b0:*:*:*:*:*:*:* Versions fw950.b0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.c0:*:*:*:*:*:*:* Versions fw950.c0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.c1:*:*:*:*:*:*:* Versions fw950.c1 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.c2:*:*:*:*:*:*:* Versions fw950.c2 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.d0:*:*:*:*:*:*:* Versions fw950.d0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.d1:*:*:*:*:*:*:* Versions fw950.d1 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.e0:*:*:*:*:*:*:* Versions fw950.e0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.e1:*:*:*:*:*:*:* Versions fw950.e1 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw950.f0:*:*:*:*:*:*:* Versions fw950.f0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.00:*:*:*:*:*:*:* Versions fw1060.00 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.10:*:*:*:*:*:*:* Versions fw1060.10 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.12:*:*:*:*:*:*:* Versions fw1060.12 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.20:*:*:*:*:*:*:* Versions fw1060.20 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.21:*:*:*:*:*:*:* Versions fw1060.21 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.40:*:*:*:*:*:*:* Versions fw1060.40 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.41:*:*:*:*:*:*:* Versions fw1060.41 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.50:*:*:*:*:*:*:* Versions fw1060.50 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1060.51:*:*:*:*:*:*:* Versions fw1060.51 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1110.00:*:*:*:*:*:*:* Versions fw1110.00 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1110.01:*:*:*:*:*:*:* Versions fw1110.01 Vulnerable ·IBM
  • cpe:2.3:o:ibm:powervm_hypervisor:fw1110.03:*:*:*:*:*:*:* Versions fw1110.03 Vulnerable ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-36238
  2. 2026-10-03 Alias added: GHSA-wfpp-6h7f-cmmc

References

Patch 1

  • TI-2022-15241 IBM Power FW security bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-14280 IBM PowerVM gain access CVSS 3.1CRITICAL 9.3
  • TI-2021-16362 IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service… CVSS 3.1CRITICAL 9.1
  • TI-2021-16363 IBM PowerVM Hypervisor FW860, FW940, FW950, and FW1010, through a specific sequence of VM… CVSS 3.1HIGH 7.5
  • TI-2023-14281 IBM PowerVM Hypervisor denial of service CVSS 3.1HIGH 7.9
  • TI-2023-10961 IBM PowerVM Hypervisor information disclosure CVSS 3.1HIGH 7.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences