A critical stack-based buffer overflow vulnerability in FreeIPMI versions prior to 1.6.19 could allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges.

This vulnerability is a stack-based buffer overflow located in the _get_dell_system_info_idrac_info function within the ipmi-oem component. The flaw is reachable by an unauthenticated attacker via the idrac-info subcommand.

The vulnerability carries a CVSS score of 9.8, reflecting its critical nature and the potential for full system compromise. Successful exploitation could lead to unauthorized remote code execution, resulting in total loss of confidentiality, integrity, and availability for the affected host, which may cause significant operational downtime and data exposure.

Immediate Action: Update FreeIPMI to version 1.6.19 or later as provided by the vendor.

Proactive Monitoring: Review system and application logs for unusual crashes or unexpected execution patterns involving the ipmi-oem utility.

Compensating Controls: Implement network access controls to restrict access to IPMI interfaces to trusted management networks only, thereby reducing the attack surface.

Public Exploit Available: Unknown

Given the critical severity and the potential for unauthenticated remote code execution, organizations should prioritize patching FreeIPMI immediately. System administrators must ensure that all instances of FreeIPMI are updated to version 1.6.19 or higher to eliminate this high-risk vulnerability.