diff --git a/user_channel/usercommands.cpp b/user_channel/usercommands.cpp
index 622857c..9a23ac3 100644
--- a/user_channel/usercommands.cpp
+++ b/user_channel/usercommands.cpp
@@ -359,6 +359,11 @@
     // subtract 2 bytes header to know the password length - including NULL
     uint8_t passwordLength = *dataLen - 2;
     *dataLen = 0;
+    if (req->reserved1 || req->reserved2)
+    {
+        log<level::DEBUG>("Invalid data field in request");
+        return ccInvalidFieldRequest;
+    }
 
     // verify input length based on operation. Required password size is 20
     // bytes as  we support only IPMI 2.0, but in order to be compatible with