CVE-2026-33554

A flaw was found in FreeIPMI. The ipmi-oem program is used to send Intelligent Platform Management Interface (IPMI) OEM commands for specific hardware vendors to retrieve specific information from the hardware. A malicious server can reply with crafted response messages and cause buffer overflows when processed, potentially resulting in a denial of service and memory corruption.

To exploit this vulnerability, a user needs to execute the ipmi-oem program to retrieve information from a compromised or malicious Baseboard Management Controller (BMC) server, limiting the exposure of this flaw.

Specifically, the following ipmi-oem commands are vulnerable to this issue:

• ipmi-oem dell get-last-post-code
• ipmi-oem supermicro extra-firmware-info
• ipmi-oem wistron read-proprietary-string

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this flaw has been rated with a moderate severity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure all BMCs and the servers running FreeIPMI are isolated on a dedicated and restricted network environment.