LiveActive security incident?Get immediate response
CVE Record

CVE-2018-1992: The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validatin...

The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.

MediumCVSS 6.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This issue affects IBM Power9 boot firmware in listed OP910, OP920, and FW910 versions. If an attacker can replace the first boot firmware image with a specially crafted malicious image, secure boot protections may be bypassed and persistent compromise could follow.

Executive priority

Treat this as a targeted infrastructure risk, not a broad internet emergency. The impact could be severe on affected systems, but known exploitation evidence is absent and access requirements are high.

Technical view

The bootloader has a buffer overflow during loading and validation of the initial boot firmware image. The CVSS vector indicates local access, high privileges, high attack complexity, and high confidentiality, integrity, and availability impact. IBM X-Force tracks it as ID 154345.

Likely exposure

Exposure appears limited to IBM Power9 systems running OP910, OP920, or FW910 firmware. Risk is highest where attackers could gain privileged local control, maintenance access, or firmware replacement capability.

Exploitation context

The source bundle does not show active exploitation, and CISA KEV is false. Exploitation requires the ability to replace boot firmware with a carefully crafted large image, which implies significant access and preparation.

Researcher notes

Do not assume all IBM Power systems are affected. The provided affected set is IBM Power 9 Systems with FW910, OP910, and OP920. The bundle names an IBM advisory but does not include specific fixed firmware levels.

Mitigation direction

  • Review IBM advisory ibm10868992 for supported remediation and firmware guidance.
  • Inventory IBM Power9 systems running OP910, OP920, or FW910 firmware.
  • Prioritize remediation for systems with broad admin, maintenance, or physical access exposure.
  • Restrict firmware update paths to trusted administrators and approved maintenance processes.
  • Monitor IBM and X-Force references for updated guidance.

Validation and detection

  • Confirm whether any IBM Power9 systems use OP910, OP920, or FW910 firmware.
  • Compare installed firmware levels against IBM advisory guidance.
  • Review recent firmware maintenance records for unauthorized or unusual image changes.
  • Validate controls around firmware update authorization and physical system access.
  • Document non-applicability for non-Power9 or non-listed firmware environments.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-1992 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.4 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/PR:H/AV:L/S:U/I:H/UI:N/AC:H/A:H/C:H/RC:C/E:U/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.4CVSS 3.0MediumCVSS:3.0/PR:H/AV:L/S:U/I:H/UI:N/AC:H/A:H/C:H/RC:C/E:U/RL:O0.55.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.4Medium
CVSS 3.0 vector shape for CVE-2018-1992Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/PR:H/AV:L/S:U/I:H/UI:N/AC:H/A:H/C:H/RC:C/E:U/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMPower 9 SystemsFW910, OP910, OP920Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.