PT-2026-27437 · Wistron+4 · Wistron Servers+4
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
FreeIPMI versions prior to 1.16.17
Description
The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management and is implemented by numerous hardware manufacturers to support system management. It is commonly used for sensor reading and remote power control. The
ipmi-oem client command implements IPMI OEM commands for specific hardware vendors. Three subcommands were found to have exploitable buffer overflows in response messages: 'ipmi-oem dell get-last-post-code' for retrieving the last POST code and error description on some Dell servers, 'ipmi-oem supermicro extra-firmware-info' for obtaining extra firmware information on Supermicro servers, and 'ipmi-oem wistron read-proprietary-string' for reading a proprietary string on Wistron servers.Recommendations
Versions prior to 1.16.17 should be updated to version 1.16.17 or later.
Fix
DoS
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dell Servers
Freeipmi
Rocky Linux
Supermicro Servers
Wistron Servers