ipmitool (IPMI LAN response parsing): Reverses the usual direction of BMC risk: here the management station

Impact

Reverses the usual direction of BMC risk: here the management station is the victim. ipmitool does not validate data returned by the remote BMC, so a malicious or already-compromised BMC overflows buffers in the tool and executes code on the machine running it. Because operators run ipmitool from automation hosts, in loops, across the whole fleet, and usually as root, one compromised BMC escalates into ownership of the box that holds credentials for every other BMC. That is the fastest path from a single node to the entire management plane.

Who can reach it

Any BMC that your tooling talks to. A single compromised or spoofed BMC on the management network is enough - and BMC-to-management-host is a trust direction almost nobody models.

What to do

Package update to ipmitool 1.8.19 or later on every management/automation host - no firmware, no reboot, just the package and restarting any long-running collector. Cheap fix, high leverage. Also worth reviewing whether your fleet automation really needs to run ipmitool as root, and whether the credentials it holds are scoped per rack rather than fleet-wide.

References