« Volver al listado

CVE-2026-50031

Estado: Pendiente de análisisAlta (7.5)—

ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors.

Leer descripción completaMostrar menos

If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands "ipmi-oem dell get-active-directory-config" and "ipmi-oem fujitsu get-sel-entry-long-text" were found to have exploitable buffer overflows on response messages.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Buffer overflow en respuesta de servidor IPMI remoto (AV:N, PR:N, UI:N) sin requerir autenticación. DoS por corrupción de memoria.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Freeipmi — FreeipmiAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-50031",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-50031",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-03T13:38:19.384737Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "repo": "https://savannah.gnu.org/projects/freeipmi/",
          "vendor": "FreeIPMI",
          "modules": [
            "ipmi-oem"
          ],
          "product": "FreeIPMI",
          "versions": [
            {
              "status": "affected",
              "version": "0.7.12",
              "lessThan": "1.6.18",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "ipmi-oem/ipmi-oem-fujitsu.c",
            "ipmi-oem/ipmi-oem/ipmi-oem-dell.c"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-03T04:17:07.330",
  "references": [
    {
      "url": "https://lists.gnu.org/archive/html/info-gnu/2026-06/msg00000.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://savannah.gnu.org/bugs/index.php?68363",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://savannah.gnu.org/bugs/index.php?68364",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface (IPMI) specification defines a set of interfaces for platform management. It is implemented by a large number of hardware manufacturers to support system management. It is most commonly used for sensor reading (e.g., CPU temperatures through the ipmi-sensors command within FreeIPMI) and remote power control (the ipmipower command). The ipmi-oem client command implements a set of a IPMI OEM commands for specific hardware vendors. If a user has supported hardware, they may wish to use the ipmi-oem command to send a request to a server to retrieve specific information. Two subcommands \"ipmi-oem dell get-active-directory-config\" and \"ipmi-oem fujitsu get-sel-entry-long-text\" were found to have exploitable buffer overflows on response messages."
    },
    {
      "lang": "es",
      "value": "ipmi-oem en FreeIPMI anterior a 1.6.18 tiene desbordamientos de búfer explotables en mensajes de respuesta. La especificación de la Interfaz de Gestión de Plataforma Inteligente (IPMI) define un conjunto de interfaces para la gestión de plataformas. Es implementada por un gran número de fabricantes de hardware para soportar la gestión del sistema. Se utiliza más comúnmente para la lectura de sensores (por ejemplo, temperaturas de CPU a través del comando ipmi-sensors dentro de FreeIPMI) y el control remoto de energía (el comando ipmipower). El comando cliente ipmi-oem implementa un conjunto de comandos IPMI OEM para proveedores de hardware específicos. Si un usuario tiene hardware compatible, puede desear usar el comando ipmi-oem para enviar una solicitud a un servidor para recuperar información específica. Se encontró que dos subcomandos 'ipmi-oem dell get-active-directory-config' y 'ipmi-oem fujitsu get-sel-entry-long-text' tenían desbordamientos de búfer explotables en mensajes de respuesta."
    }
  ],
  "lastModified": "2026-07-22T19:10:00.120",
  "sourceIdentifier": "cve@mitre.org"
}