CVE-2013-6306· NVD / CVE Program· CNA ibm

Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_0

Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

MediumCVSS 4.6 · v2.0—No exploit No fix recorded

Local privilege escalation

Published: Aug 22, 2014
Updated: Jun 16, 2026
EPSS: 0.3% · 22th percentile
CWE: —

Follow this CVE

Report tools

JSON

Action score

Monitor

Low priority for now.

CVSS: 18 / 40 · 4.6 / 10
CISA KEV: 0 / 30 · Not listed
EPSS: 0 / 30 · 0.3%

Noroxi analysis

No Noroxi analysis for this record yet

We don't hand-write analysis for the hundreds of thousands of vulnerabilities in the database; that wouldn't be honest. For notable, high-impact vulnerabilities our team writes the mechanism, detection and remediation steps.

We use this product, ask for help

Affected systems

Vendor	Product	CPE
ibm	power 760 firmware	cpe:2.3:o:ibm:power_760_firmware
ibm	power 770	cpe:2.3:h:ibm:power_770
ibm	power 780	cpe:2.3:h:ibm:power_780
ibm	power 795	cpe:2.3:h:ibm:power_795
ibm	power ese	cpe:2.3:h:ibm:power_ese
ibm	power 740 firmware	cpe:2.3:o:ibm:power_740_firmware
ibm	power 710	cpe:2.3:h:ibm:power_710
ibm	power 720	cpe:2.3:h:ibm:power_720
ibm	power 730	cpe:2.3:h:ibm:power_730
ibm	power 740	cpe:2.3:h:ibm:power_740
ibm	power 770 firmware	cpe:2.3:o:ibm:power_770_firmware
ibm	power 750	cpe:2.3:h:ibm:power_750

and 3 more

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

ibm power 7108231-e1c
ibm power 7108231-e1d
ibm power 7108268-e1d
ibm power 7208202-e4c
ibm power 7208202-e4d
ibm power 7308231-e2c
ibm power 7308231-e2d
ibm power 7408205-e6c
ibm power 7408205-e6d
ibm power 740 firmware740.00_01ax740_042_042
ibm power 740 firmware740.10_01ax740_043_042
ibm power 740 firmware740.15_01ax740_045_042
ibm power 740 firmware740.16_01ax740_046_042
ibm power 740 firmware740.20_01ax740_075_042
ibm power 740 firmware740.21_01ax740_077_042
ibm power 740 firmware740.40_01ax740_088_042
ibm power 740 firmware740.50_01ax740_095_042
ibm power 740 firmware740.51_01ax740_098_042
ibm power 740 firmware740.52_01ax740_100_042
ibm power 740 firmware740.60_01ax740_110_042

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

No fix version is recorded for this entry. Check the references for vendor advisories.

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.

Timeline

From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.

No dated events beyond publication.

EPSS, last 120 days

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Patch and commit links

Commit, PR and diff links among the references. A starting point for patch-diffing and variant hunting; fixes, not exploits.

No commit or PR link among the references.

Credits

All researchers

Finders, reporters and analysts named in the CNA record. Click a name for that researcher’s other records.

No credits in the CNA record.

Variant candidates

Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.

No nightly-computed relations.

Chain candidates

An authentication bypass and a privilege-requiring bug in the same product, published close together: combined they may become an unauthenticated path.

—

Bug bounty scope

IBMHackerOne · disclosure only (VDP)

The product’s vendor appears in a public program. Matched by name; verify the scope text in the program.

Technical details

Attack conditions

No special conditions are required; it is repeatable.

If successful

Confidentiality: P · data can be read
Integrity: P · data or configuration can be modified
Availability: P · the service can be disrupted

Attack complexity: Low
Confidentiality impact: P
Integrity impact: P
Availability impact: P

Weakness class (CWE)

—

CVSS vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

nvd-primary

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.

Change log

No changes recorded on tracked fields yet. Score, KEV, exploit maturity and fix status changes appear here.

References

Vendor advisories and official records. Exploit/PoC links are deliberately left out.

All records