Medium severity · published Jul 29, 2021
CVE-2021-20505
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised
4.4
CVSS
0.5%
EPSS
No
On KEV
Description
The PowerVM Logical Partition Mobility(LPM) (PowerVM Hypervisor FW920, FW930, FW940, and FW950) encryption key exchange protocol can be compromised. If an attacker has the ability to capture encrypted LPM network traffic and is able to gain service access to the FSP they can use this information to perform a series of PowerVM service procedures to decrypt the captured migration traffic IBM X-Force ID: 198232
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 46% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
Powervm Hypervisor · Ibm
fw920; fw930; fw940; fw950 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20505
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20505
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/198232
Vendor Advisory
https://www.ibm.com/support/pages/node/6475619
More from Powervm Hypervisor
9.8
CVE-2022-34331
After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configuration being…
9.1
CVE-2021-38917
IBM PowerVM Hypervisor FW860, FW940, and FW950 could allow an attacker that gains service access to the FSP can read and write arbitrary host system memory through a series of…
8.8
CVE-2023-30438
An internally discovered vulnerability in PowerVM on IBM Power9 and Power10 systems could allow an attacker with privileged user access to a logical partition to perform an…
8.4
CVE-2026-11885
Power System update in Buffer Copy
8.2
CVE-2026-96262
IBM Power Systems Firmware Buffer Overflow