CVE-2026-85506 in FreeIPMI
Summary
by MITRE • 09/04/2026
ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified as CVE-2023-46589 represents a critical stack-based buffer overflow within the FreeIPMI software suite, specifically affecting versions prior to 1.6.19. This flaw is located in the _get_dell_system_info_idrac_info function found in the ipmi-oem/ipmi-oem-dell.c source file. The vulnerability manifests when users execute the dell get-system-info subcommand via the ipmi-oam utility, which interacts with Dell Integrated Remote Access Controller (iDRAC) hardware to retrieve system information. The core technical issue stems from improper validation of input data lengths before copying them into fixed-size stack buffers. When an iDRAC device returns a response containing fields that exceed the expected size limits defined in the FreeIPMI code, the application fails to perform adequate bounds checking. Consequently, this leads to writing data beyond the allocated memory space on the call stack, overwriting adjacent memory locations including return addresses and saved frame pointers.
From a technical perspective, this is classified under CWE-121: Stack-based Buffer Overflow. The exploitation of this vulnerability allows an attacker with access to the IPMI interface or network path leading to it to inject malicious shellcode into the overwritten stack space. By carefully crafting the response data from the iDRAC device, which acts as a remote management controller, an adversary can manipulate the control flow of the ipmi-oem process. Upon function return, the corrupted instruction pointer directs execution to the attacker-controlled payload. This mechanism is particularly dangerous because IPMI services often run with elevated privileges or have direct access to critical system hardware interfaces. The ability to execute arbitrary code in this context effectively grants full compromise of the host machine running FreeIPMI and potentially allows lateral movement within the data center infrastructure if the compromised process has broader network permissions.
The operational impact of this vulnerability extends beyond simple remote code execution on the local host where FreeIPMI is installed. Since IPMI is a standard protocol used for out-of-band management, an attacker could leverage this flaw to disrupt system availability by crashing the ipmi-oem service or causing kernel panics if memory corruption affects critical structures. Furthermore, successful exploitation enables persistent access through backdoors implanted via the executed payload. This aligns with MITRE ATT&CK technique T1059: Command and Scripting Interpreter, as the attacker gains a foothold to run further commands. It also relates to T1203: Exploitation for Client Execution if the vulnerability is triggered during automated inventory collection processes that might be part of routine IT operations. The risk is amplified in environments where FreeIPMI tools are used by administrators or automation scripts without strict input sanitization, as these workflows may process data from untrusted or compromised hardware components.
Mitigation strategies primarily involve upgrading to FreeIPMI version 1.6.19 or later, which includes patches for the buffer overflow issue through improved input validation and bounds checking in the _get_dell_system_info_idrac_info function. Organizations should audit their inventory of systems running older versions of FreeIPMI and prioritize patching those that interact with Dell iDRAC controllers over untrusted networks. In addition to software updates, network segmentation is recommended to restrict access to IPMI interfaces only from authorized management stations. Implementing strict firewall rules that limit traffic on UDP port 623 can reduce the attack surface significantly. Security teams should also monitor for anomalous behavior in system logs related to ipmi-oem crashes or unexpected memory usage spikes, which may indicate attempted exploitation of this vulnerability. Regular security assessments and penetration testing focusing on out-of-band management interfaces are essential to ensure that such vulnerabilities do not persist in production environments.