CVE-2012-2188
IBM Power HMC & SDMC Firmware Privilege Escalation via VIOS viosrvcmd
Title source: llmDescription
IBM Power Hardware Management Console (HMC) 7R3.5.0 before SP4, 7R7.1.0 and 7R7.2.0 before 7R7.2.0 SP3, and 7R7.3.0 before SP2, and Systems Director Management Console (SDMC) 6R7.3.0 before SP2, does not properly restrict the VIOS viosrvcmd command, which allows local users to gain privileges via vectors involving a (1) $ (dollar sign) or (2) & (ampersand) character.
References (6)
Core 6
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/75906
Various Sources vendor-advisory
x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1MB03580
Various Sources vendor-advisory
x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1MB03554
Various Sources vendor-advisory
x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1MB03550
Vendor Advisory x_refsource_confirm
http://www.ibm.com/connections/blogs/PSIRT/entry/security_bulletin_power_hmc_viosrvcmd_command_allows_elevated_privilege_on_vios_cve_2012_218825
Various Sources vendor-advisory
x_refsource_aixapar
http://www.ibm.com/support/docview.wss?uid=isg1MB03548
Scores
EPSS
0.0035
EPSS Percentile
27.2%
Details
CWE
CWE-264
Status
published
Products (5)
ibm/power_hardware_management_console_firmware
7r3.5.0
ibm/power_hardware_management_console_firmware
7r7.1.0
ibm/power_hardware_management_console_firmware
7r7.2.0
ibm/power_hardware_management_console_firmware
7r7.3.0
ibm/systems_director_management__console_firmware
6r7.3.0
Published
Aug 06, 2012
Tracked Since
Feb 18, 2026