JVNDB-2026-001663

"iRMC S5/S6" implemented in PRIMERGY vulnerable to incorrect authorization

Remote Management Controller "iRMC S5/S6" implemented in PRIMERGY provided by Fsas Technologies Inc. contains the following vulnerability.

• Incorrect authorization (CWE-863 - CVE-2025-65002)

Fsas Technologies Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN.

Multiple products implementing Remote Management Controller "iRMC S5/S6" are affected by the vulnerability.
As for the details of affected products, refer to the information provided by the developer.

Note that "iRMC S4" is not affected by the vulnerability.

Fsas Technologies Inc.

• (multiple product)

A user with privileges other than "Administrator" may be able to access the Web UI or use the Redfish API beyond the intended privilege level.

[Update the Software]
Update the software to the latest version according to the information provided by the developer.

[Apply the workaround]
Until the software is updated, applying the following workaround is recommended to mitigate the impact of the vulnerability.

• Set the username for users registering with iRMC to 15 characters limit

For the details, refer to the information provided by the developer.

Fsas Technologies Inc.

• Fsas Technologies Inc. : Fsas Technologies Inc. website
• JVN : Information from Fsas Technologies Inc.

1. Incorrect Authorization(CWE-863) [Other]

1. CVE-2025-65002

1. JVN : JVNVU#95177764

• [2026/01/23]
    Web page was published