24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login
Over 36,000 internet-exposed Baseboard Management Controllers (BMCs) are vulnerable to CVE-2013-4786, a 20-year-old IPMI v2.0 flaw that leaks password-derived authentication hashes before login. The vulnerability enables offline brute-force attacks on BMC credentials, with over 30% of exposed hashes recoverable using common wordlists or factory-default patterns. Affected systems include modern Supermicro and HPE servers used in AI data centers, where compromised BMCs pose high risk due to out-of
Analysis
TL;DR
- Over 36,000 internet-exposed Baseboard Management Controllers (BMCs) are vulnerable to CVE-2013-4786, a 20-year-old IPMI v2.0 flaw that leaks password-derived authentication hashes before login.
- The vulnerability enables offline brute-force attacks on BMC credentials, with over 30% of exposed hashes recoverable using common wordlists or factory-default patterns.
- Affected systems include modern Supermicro and HPE servers used in AI data centers, where compromised BMCs pose high risk due to out-of-band management capabilities and multi-tenant infrastructure.
- No software patch exists for the specification-level flaw; mitigation requires network hardening, password rotation, and restricting BMC access to private networks.
- Threat actors have already exploited exposed BMCs, including ransomware notes left on HPE iLO interfaces, indicating active exploitation in the wild.
Why It Matters
This vulnerability represents a critical blind spot in modern IT and AI infrastructure security. BMCs operate independently of the host OS and provide deep hardware control, meaning compromise can lead to persistent, undetectable access across entire data centers. As AI workloads increasingly rely on bare-metal GPU clusters, securing these foundational management layers is essential to prevent lateral movement, firmware-level malware, and large-scale credential theft.
Technical Details
- Vulnerability: CVE-2013-4786 (CVSS 7.5) – Information disclosure in IPMI v2.0 specification allowing unauthenticated remote access to HMAC-SHA1 authentication codes derived from passwords during RAKP handshake.
- Exploitation Mechanism: Attackers send requests to UDP port 623 (IPMI default) to receive RAKP response messages containing HMAC values computed with the account’s password and known session parameters, enabling offline password guessing without triggering lockouts.
- Scope: 36,872 globally exposed BMCs identified as of May 6, 2026; 24,650 leak authentication material pre-login; 6,240 respond to empty usernames with weak password matches; 2,340 return valid credentials for ADMIN/root accounts using public wordlists.
- Affected Vendors: Dell (acknowledges inherent spec flaw), Supermicro (evaluating policy changes), HPE (iLO firmware historically targeted by iLOBleed rootkit).
- Recovery Speed: HPE iLO factory passwords cracked in <1 minute using GPUs; Supermicro unique passwords recovered in ~1 hour despite per-server uniqueness.
- Network Exposure: Majority located in U.S. (>14,000), followed by Germany, China, Netherlands, UK — indicating widespread misconfiguration in enterprise and cloud environments.
Industry Insight
- AI Infrastructure Risk Amplification: In shared bare-metal AI clusters, a single compromised BMC can expose multiple tenants’ workloads via lateral movement or firmware manipulation, making BMC hygiene a multi-tenant security imperative.
- Shift from Patching to Defense-in-Depth: Since no vendor patch exists for the IPMI spec flaw, organizations must adopt zero-trust network segmentation, disable legacy protocols (IPMI 1.5), enforce strong provisioning policies, and monitor UDP 623 traffic.
- Emerging Exploitation Trend: Presence of ransomware notes on exposed iLO interfaces confirms real-world targeting; this signals a shift from theoretical risk to active commoditization of BMC exploits in cybercrime toolkits.
Disclaimer: The above content is generated by AI and is for reference only.