ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."

rocky_linux RLSA-2026:13515: RLSA-2026:13515: freeipmi security update (Moderate)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-13515 advisory.

    [1.6.17-1]
    - Update to 1.6.17

    [1.6.14-6]
    - .fmf/version: Add fmf metadtata root

    [1.6.14-5]
    - gating: RHEL-10: Add OSCI testing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13515 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20556-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21212-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007097 advisory.

    ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were     found to have exploitable buffer overflows on response messages. They are: ipmi-oem dell get-last-post-     code - get the last POST code and string describing the error on some Dell servers, ipmi-oem supermicro     extra-firmware-info - get extra firmware info on Supermicro servers, and ipmi-oem wistron read-     proprietary-string - read a proprietary string on Wistron servers.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were     found to have exploitable buffer overflows on response messages. They are: ipmi-oem dell get-last-post-     code - get the last POST code and string describing the error on some Dell servers, ipmi-oem supermicro     extra-firmware-info - get extra firmware info on Supermicro servers, and ipmi-oem wistron read-     proprietary-string - read a proprietary string on Wistron servers. (CVE-2026-33554)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
312313	Oracle Linux 10 : freeipmi (ELSA-2026-13515)	Nessus	Oracle Linux Local Security Checks	high
312089	RHEL 10 : freeipmi (RHSA-2026:13515)	Nessus	Red Hat Local Security Checks	high
309152	openSUSE 16 Security Update : freeipmi (openSUSE-SU-2026:20556-1)	Nessus	SuSE Local Security Checks	high
309115	SUSE SLES16 Security Update : freeipmi (SUSE-SU-2026:21212-1)	Nessus	SuSE Local Security Checks	high
305936	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freeipmi (UTSA-2026-007097)	Nessus	Unity Linux Local Security Checks	high
303520	Linux Distros Unpatched Vulnerability : CVE-2026-33554	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33554

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high