ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were found to have exploitable buffer overflows on response messages. They are: "ipmi-oem dell get-last-post-code - get the last POST code and string describing the error on some Dell servers," "ipmi-oem supermicro extra-firmware-info - get extra firmware info on Supermicro servers," and "ipmi-oem wistron read-proprietary-string - read a proprietary string on Wistron servers."

alma_linux ALSA-2026:20579: ALSA-2026:20579: freeipmi security update (Medium)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-20579 advisory.

    [1.6.17-1]
    - Update to 1.6.17, fixes CVE-2026-33554

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:20579 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0117 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-33554:
    ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were     found to have exploitable buffer overflows on response messages. They are: ipmi-oem dell get-last-post-     code - get the last POST code and string describing the error on some Dell servers, ipmi-oem supermicro     extra-firmware-info - get extra firmware info on Supermicro servers, and ipmi-oem wistron read-     proprietary-string - read a proprietary string on Wistron servers.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:19208 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19208 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:19053 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:14819 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-584:01 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:1754-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1755-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:14819 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-14819 advisory.

    [1.6.17-1]
    - Update to 1.6.17, fixes CVE-2026-33554

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:14819 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:13515 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:13515 advisory.

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-13515 advisory.

    [1.6.17-1]
    - Update to 1.6.17

    [1.6.14-6]
    - .fmf/version: Add fmf metadtata root

    [1.6.14-5]
    - gating: RHEL-10: Add OSCI testing

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:13515 advisory.

    The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and     system management software based on the IPMI specification.

    Security Fix(es):

    * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20556-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:21212-1 advisory.

    This update for freeipmi fixes the following issue:

    - CVE-2026-33554: improper memory handling and data validation can lead to stack buffer overflows and     acceptance of       malformed payloads/responses (bsc#1260414).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007097 advisory.

    ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were     found to have exploitable buffer overflows on response messages. They are: ipmi-oem dell get-last-post-     code - get the last POST code and string describing the error on some Dell servers, ipmi-oem supermicro     extra-firmware-info - get extra firmware info on Supermicro servers, and ipmi-oem wistron read-     proprietary-string - read a proprietary string on Wistron servers.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipmi-oem in FreeIPMI before 1.16.17 has exploitable buffer overflows on response messages. The Intelligent     Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It     is implemented by a large number of hardware manufacturers to support system management. It is most     commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI)     and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI     OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the     ipmi-oem command to send a request to a server to retrieve specific information. Three subcommands were     found to have exploitable buffer overflows on response messages. They are: ipmi-oem dell get-last-post-     code - get the last POST code and string describing the error on some Dell servers, ipmi-oem supermicro     extra-firmware-info - get extra firmware info on Supermicro servers, and ipmi-oem wistron read-     proprietary-string - read a proprietary string on Wistron servers. (CVE-2026-33554)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
316885	Oracle Linux 8 : freeipmi (ELSA-2026-20579)	Nessus	Oracle Linux Local Security Checks	high
316882	RHEL 8 : freeipmi (RHSA-2026:20579)	Nessus	Red Hat Local Security Checks	high
316643	Alibaba Cloud Linux 3 : 0117: freeipmi (ALINUX3-SA-2026:0117)	Nessus	Alibaba Cloud Linux Local Security Checks	high
315544	RockyLinux 9 : freeipmi (RLSA-2026:19208)	Nessus	Rocky Linux Local Security Checks	high
315470	RHEL 9 : freeipmi (RHSA-2026:19208)	Nessus	Red Hat Local Security Checks	high
315398	RHEL 10 : freeipmi (RHSA-2026:19053)	Nessus	Red Hat Local Security Checks	high
314168	RockyLinux 9 : freeipmi (RLSA-2026:14819)	Nessus	Rocky Linux Local Security Checks	high
314149	MiracleLinux 9 : freeipmi-1.6.17-1.el9_7 (AXSA:2026-584:01)	Nessus	Miracle Linux Local Security Checks	high
313644	SUSE SLES12 Security Update : freeipmi (SUSE-SU-2026:1754-1)	Nessus	SuSE Local Security Checks	high
313636	SUSE SLED15 / SLES15 Security Update : freeipmi (SUSE-SU-2026:1755-1)	Nessus	SuSE Local Security Checks	high
313285	AlmaLinux 9 : freeipmi (ALSA-2026:14819)	Nessus	Alma Linux Local Security Checks	high
313220	Oracle Linux 9 : freeipmi (ELSA-2026-14819)	Nessus	Oracle Linux Local Security Checks	high
313108	RHEL 9 : freeipmi (RHSA-2026:14819)	Nessus	Red Hat Local Security Checks	high
312680	AlmaLinux 10 : freeipmi (ALSA-2026:13515)	Nessus	Alma Linux Local Security Checks	high
312370	RockyLinux 10 : freeipmi (RLSA-2026:13515)	Nessus	Rocky Linux Local Security Checks	high
312313	Oracle Linux 10 : freeipmi (ELSA-2026-13515)	Nessus	Oracle Linux Local Security Checks	high
312089	RHEL 10 : freeipmi (RHSA-2026:13515)	Nessus	Red Hat Local Security Checks	high
309152	openSUSE 16 Security Update : freeipmi (openSUSE-SU-2026:20556-1)	Nessus	SuSE Local Security Checks	high
309115	SUSE SLES16 Security Update : freeipmi (SUSE-SU-2026:21212-1)	Nessus	SuSE Local Security Checks	high
305936	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: freeipmi (UTSA-2026-007097)	Nessus	Unity Linux Local Security Checks	high
303520	Linux Distros Unpatched Vulnerability : CVE-2026-33554	Nessus	Misc.	high

Detections

Analytics

CVE-2026-33554

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high