CVE-2021-20487

CRITICAL

9.1

CVSS Score

Published: May 26, 2021 at 04:20 PM UTC

Updated: June 17, 2026 at 03:33 AM UTC

19 products affected across 1 vendorPOWER9 System FirmwareScale Out Lc System Firmware9009-42A

Using Power 9 Systems by IBM?

Get instant alerts when new vulnerabilities affect Power 9 Systems - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

CRITICAL9.1

Exploit prediction

EPSS 0.7%

Description

IBM Power9 Self Boot Engine(SBE) could allow a privileged user to inject malicious code and compromise the integrity of the host firmware bypassing the host firmware signature verification process.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

POWER9 System Firmware · IBM

95%

v < fw950.00fw930.00 ≤ v < fw930.30fw940.00 ≤ v < fw940.20

Affected range stops below fw930.30, so it looks safe — our inference, not a vendor statement

Affected range stops below fw940.20, so it looks safe — our inference, not a vendor statement

Affected range stops below fw950.00, so it looks safe — our inference, not a vendor statement

ibm-9008-22l (environment) · ibm-9009-22a (environment) · ibm-9009-22g (environment) · ibm-9009-41a (environment) · ibm-9009-41g (environment) · ibm-9009-42a (environment) · ibm-9009-42g (environment) · ibm-9040-mr9 (environment) · ibm-9080-m9s (environment) · ibm-9223-22h (environment) · ibm-9223-22s (environment) · ibm-9223-42h (environment) · ibm-9223-42s (environment)

Scale Out Lc System Firmware · IBM

95%

v < op940.20

Affected range stops below op940.20, so it looks safe — our inference, not a vendor statement

ibm-8335-gth (environment) · ibm-8335-gtx (environment) · ibm-9183-22x (environment)

Power9 Systems · IBM

60%

FW930 FW940 FW941 OP940

8335-Gth · IBMdevice

80%

All versions

8335-Gtx · IBMdevice