CVE-2026-33554

freeipmi: buffer overflows on response messages via ipmi-oem

Published Mar 24, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."

Analysis

Technical impact

The vulnerability involves unbounded buffer copies on response messages in the ipmi-oem client of FreeIPMI. A maliciously crafted response from an IPMI server can overflow internal buffers when the client processes subcommands such as "ipmi-oem dell get-last-post-code", "ipmi-oem supermicro extra-firmware-info" or "ipmi-oem wistron read-proprietary-string". This memory corruption can be exploited, potentially enabling arbitrary code execution or denial‑of‑service on the host running the client. This weakness maps to CWE‑120 and CWE‑121.

Affected Systems

All installations of FreeIPMI version 1.6.17 or earlier that use the ipmi-oem client against supported hardware are affected. The issue manifests when interacting with Dell, Supermicro or Wistron servers that support the specific OEM subcommands described. The affected products are the FreeIPMI suite on any operating system that can execute the ipmi-oem command.

Risk and Exploitability

The CVSS v3 score of 7.5 indicates significant impact, while the EPSS score is 0.00062 (<1%) and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to have network access to the IPMI interface and the ability to trigger the ipmi-oem commands, or a local user with sufficient privileges to run the client. The likely attack vector is remote, using crafted IPMI packets sent to a server that forwards responses back to the client, which then overflows its buffers.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

FreeIPMI

unaffected

Version	Status	Constraints
`0.7.12`	affected	< 1.6.17

No data.

Vendor Product Versions

Gnu

Freeipmi

Version	Status	Scheme	Platform
`[0.0.0,1.16.17)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade FreeIPMI to version 1.6.17 or newer.
If an upgrade cannot be performed immediately, restrict use of the ipmi‑oem command or prevent execution of the vulnerable subcommands on affected systems.
Verify that only trusted users have permissions to run ipmi‑oem; consider disabling unnecessary IPMI OEM commands via host or firmware settings if possible.
Monitor for signs of memory corruption or unexpected process crashes in systems running the ipmi‑oem utility.

Generated by OpenCVE AI on June 3, 2026 at 05:51 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-8613-1	FreeIPMI vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.428% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
http://www.openwall.com/lists/oss-security/2026/06/03/1
https://ftp.gnu.org/gnu/freeipmi/
https://nvd.nist.gov/vuln/detail/CVE-2026-33554
https://savannah.gnu.org/bugs/?68140
https://savannah.gnu.org/bugs/?68141
https://savannah.gnu.org/bugs/?68142
https://www.cve.org/CVERecord?id=CVE-2026-33554

History

Jun 3, 2026 4:30 AM Added references View changes

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2026/06/03/1

Jun 3, 2026 4:00 AM Description updated View changes

Type	Values Removed	Values Added
Description	ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."	ipmi-oem in FreeIPMI before 1.6.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."

Mar 25, 2026 12:00 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Gnu Gnu freeipmi
Vendors & Products		Gnu Gnu freeipmi

Mar 25, 2026 12:15 AM Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Title		freeipmi: buffer overflows on response messages via ipmi-oem
Weaknesses		CWE-120
References		https://nvd.nist.gov/vuln/detail/CVE-2026-33554 https://www.cve.org/CVERecord?id=CVE-2026-33554
Metrics	threat_severity `None`	threat_severity `Moderate`

Mar 24, 2026 7:15 PM Weaknesses updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-121
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mar 24, 2026 2:45 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."
References		https://ftp.gnu.org/gnu/freeipmi/ https://savannah.gnu.org/bugs/?68140 https://savannah.gnu.org/bugs/?68141 https://savannah.gnu.org/bugs/?68142