Redfish Inspector
Check a BMC in your browser
Paste what your BMC answers on Redfish. The page finds the vendor and firmware version, lists the known CVEs that NVD says affect that version, and checks the settings that open the power path. What you paste stays in this page: the one request it makes is for the public CVE list of the vendor it detects.
1. Collect the answers (read-only)
Run it on a machine that reaches the BMC. Use a read-only account; every call is a GET. You can also paste any single Redfish resource, or several, as they come.