A critical OS command injection vulnerability in IBM HMC allows unauthenticated remote attackers to execute arbitrary code with elevated privileges, potentially resulting in total system takeover.

The management interface fails to properly validate user supplied input, which is then passed to an OS command shell. This allows an unauthenticated attacker to inject and execute arbitrary system commands.

Successful exploitation grants an attacker full control over the Hardware Management Console, which is a highly sensitive component in Power environments. A CVSS score of 9.8 reflects the critical nature of this flaw, as it allows for complete unauthorized access to system management functions and potential lateral movement within the infrastructure.

Immediate Action: Apply the latest firmware and software updates provided by IBM through the Fix Central portal for the affected HMC versions.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized administrative activity originating from unexpected network sources.

Compensating Controls: Restrict access to the HMC management interface to known, trusted administrative IP addresses via network-level firewalls or ACLs.

Public Exploit Available: Unknown.

Given the central role of the HMC in managing critical infrastructure, this vulnerability must be treated with the highest urgency. Administrators should apply the available vendor patches immediately to prevent unauthorized command execution and maintain the security of the management environment.