36,872 Exposed BMCs Leak Password Hashes and Face In-the-Wild Attacks via CVE-2013-4786
Do Son 
Shodan results for the query IPMI port:623 | Image: LAVA
TL;DR
Researchers at LAVA found 36,872 exposed BMCs on the public internet. Most leaked password-derived hashes before login through CVE-2013-4786, a 20-year-old IPMI 2.0 flaw rated high-severity. LAVA also found that attackers already target internet-exposed BMCs in the wild.
- CVE: CVE-2013-4786
- CVSS: 7.5 (High · CVSSv3)
- Product: n/a
- Affected: n/a
- Impact: The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP)...
- Status: No confirmed exploitation yet
- EPSS: 67.8% (30-day)
- Action: Apply the migration steps
Why it matters
A BMC is a server’s out-of-band brain. It can power-cycle the host, mount virtual media, and rewrite firmware. Therefore whoever controls the BMC controls the machine beneath the operating system.
The BMC also sits outside most security tools. As a result, an attacker there stays largely invisible. Worse, these controllers share flat management networks. So one compromised BMC can open a path across a data center.
Access can even persist below the operating system. Malicious firmware changes survive OS reinstalls and disk swaps. Recovery then needs firmware reflashing or hardware replacement.
The stakes climb in AI and GPU clouds. There, thousands of high-value servers share management planes, so one foothold can cross tenant boundaries.
How the attack works
CVE-2013-4786 lives in the IPMI 2.0 authentication exchange. During login, the BMC returns an HMAC-SHA1 value derived from the account password. An unauthenticated party who can reach UDP port 623 can request that value.
The attacker then cracks the hash offline. No repeated logins are needed, so nothing looks unusual on the target. Weak, reused, or factory-format passwords fall quickly. For safety, this report omits the technical exploit steps.
Predictable factory passwords
Even unique factory passwords are not safe. Supermicro sets a username of ADMIN and ten uppercase letters. That format has a fixed keyspace. LAVA says a targeted attacker with eight GPUs can search it in about an hour. HPE iLO’s shorter format fell within a minute per response.
Affected systems
The exposure is broad, per LAVA’s sourced figures. Of 36,872 exposed BMCs, 24,650 returned a hash before login. More than 30% of those hashes mapped to crackable passwords. Some 6,240 accepted a blank username, and 2,340 used a common password on a named account.
Supermicro made up over half the responding devices. Modern Supermicro and HPE servers at GPU providers were affected, some still on factory passwords. LAVA also saw about 60 newly exposed IPMI addresses appear each day.
Exploitation status
The flaw is inherent to the IPMI 2.0 spec, so there is no vendor patch. More urgently, exposed BMCs are being exploited in the wild. LAVA found an exposed HPE iLO page carrying a ransom note that demanded 0.3 BTC. Read the full write-up in LAVA’s BMC exposure research.
How to fix it
The core fix is simple. IPMI should never face the public internet. Block UDP port 623 at the network edge.
- Replace factory-issued passwords during provisioning.
- Disable weak options like IPMI 1.5, cipher suite 0, and NONE authentication.
- Restrict BMC access to a private management network, VPN, or bastion host.
- Monitor the management network apart from production workloads.
Where possible, prefer Redfish over TLS inside an isolated network. Neither IPMI nor Redfish belongs on the open internet.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
