CVE-2013-4786: IPMI Password Hash Exposure Puts BMCs at Risk

According to researchers at Lava, more than 36,000 Baseboard Management Controllers (BMC) using the IPMI protocol are reachable from the public internet, and about 24,650 of them expose account password hashes even before authentication. The root cause is an architectural flaw in the IPMI v2.0 specification, tracked as CVE-2013-4786 (CVSS 7.5). No patch exists or is expected, as the vulnerability is inherent to the protocol itself. Organizations operating servers with BMCs must immediately check whether UDP port 623 is accessible from external networks and isolate management interfaces.

The essence of CVE-2013-4786

CVE-2013-4786 is a high-severity information disclosure vulnerability in the IPMI v2.0 protocol. During the authentication process, the BMC returns an RMCP+ RAKP response message containing an HMAC-SHA1 authentication code computed from the account password and session values that are already known to the requesting party. Any unauthenticated remote user with access to UDP port 623 can request this response and then perform unlimited offline password guessing.

The key difference from a typical brute-force attack is that an offline attack does not require repeated queries to the BMC for each password candidate, making it practically invisible to intrusion detection systems and immune to lockouts based on the number of attempts.

As confirmed by Dell in its security advisory, this is “an inherent issue with the IPMI v2.0 specification,” and no fix is available.

Scale of the problem

According to a report by Lava, as of May 2026, scanning of the public internet identified 36,872 unique hosts running IPMI services on UDP port 623. Geographic distribution:

• More than 14,000 in the United States
• The rest concentrated in Germany, China, the Netherlands and the United Kingdom

Of the systems discovered, researchers report:

• About 25,000 exposed authentication material prior to login, enabling offline credential cracking
• 6,240 BMCs returned authentication data for an empty username that matched weak passwords
• 2,340 BMCs returned data for named accounts (ADMIN, root) whose passwords matched entries from publicly available dictionaries
• More than 30% of the obtained hashes were associated with passwords recoverable via common wordlists and predictable formats of factory stickers on the chassis

Important caveat: the quantitative data provided is based on a single research source and has not been independently verified.

Affected products and cracking speed

The issue affects all IPMI v2.0 implementations on BMC controllers. The report specifically calls out HPE iLO and Supermicro servers, including systems used by GPU compute providers. According to the researchers:

• Factory passwords for HPE iLO were recovered in under a minute using modern GPU hardware
• Factory passwords for Supermicro, even though they are uniquely assigned to each server, were recovered in about an hour

Supermicro has reportedly stated its intention to evaluate possible improvements to default password policies for future hardware revisions.

Why this is critical

BMCs are specialized processors embedded into the server motherboard. They manage power, firmware, remote console access, OS installation and system recovery. BMCs operate completely independently of the host operating system (out-of-band management), which means:

• Compromising the BMC allows an attacker to bypass all operating system–level security controls
• Access persists even after a full OS reinstallation
• The attacker gains control over the server’s power, firmware and console

In modern data centers, where the same physical infrastructure serves multiple tenants, a single compromised BMC can potentially jeopardize workloads belonging to several organizations.

Mitigation recommendations

Since the vulnerability is architectural and cannot be fixed with a patch, mitigation comes down to access restriction and stronger credentials:

1. Block UDP port 623 at the network perimeter — this is the top-priority measure that removes the attack vector
2. Change factory-default passwords on all BMCs when servers are commissioned, using cryptographically strong unique passwords
3. Isolate BMCs into a dedicated private management network that is not reachable from user or production segments
4. Disable legacy protocols, including IPMI 1.5, to reduce the attack surface
5. Apply network access control lists, allowing connections to BMCs only from approved administrative systems
6. Audit current exposure: verify whether UDP port 623 is reachable from external networks on all servers in the organization

The combination of an unfixable protocol vulnerability, widespread use of factory-default passwords and the increased performance of GPU-accelerated cracking makes every internet-exposed IPMI-enabled BMC a ready-made entry point for attackers. The highest priority actions are to block UDP 623 at the perimeter and move all BMC management interfaces into an isolated network. Organizations using HPE and Supermicro servers should additionally ensure that factory passwords were changed during deployment.