The ipmi-oem client in FreeIPMI before version 1.6.18 contains exploitable buffer overflows on response messages. The flaw occurs when processing response messages, enabling an attacker to corrupt memory and cause a crash, resulting in denial of service. The two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages. This compromises the availability of the system running the client.

All installations of FreeIPMI version 1.6.17 or earlier that use the ipmi-oem command, particularly the Dell "get-active-directory-config" and Fujitsu "get-sel-entry-long-text" subcommands, are affected. The vulnerability applies to any hardware supporting the IPMI specification and configured to answer these OEM requests.

The CVSS score of 7.5 classifies the flaw as high severity, and the attack requires the attacker to supply a crafted IPMI response, typically by controlling the target's IPMI interface. The EPSS score is not available and KEV does not list this vulnerability, but the nature of the buffer overflow and high CVSS still suggest a substantial exploitation risk in environments where IPMI access is not tightly controlled, primarily resulting in denial of service.