Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks
CVE-2013-4786 is a 22-year-old vulnerability in the IPMI 2.0 authentication protocol that allows offline password hash recovery from Baseboard Management Controllers Nearly 37,000 internet-exposed IPMI interfaces were found, with over 24,000 disclosing password-derived authentication hashes before login BMCs represent some of the most privileged control points in data centers, enabling power-cycling, firmware updates, and low-level platform configuration 6,240 hosts accepted empty usernames with
Analysis
TL;DR
- CVE-2013-4786 is a 22-year-old vulnerability in the IPMI 2.0 authentication protocol that allows offline password hash recovery from Baseboard Management Controllers
- Nearly 37,000 internet-exposed IPMI interfaces were found, with over 24,000 disclosing password-derived authentication hashes before login
- BMCs represent some of the most privileged control points in data centers, enabling power-cycling, firmware updates, and low-level platform configuration
- 6,240 hosts accepted empty usernames with weak passwords, and 2,340 had named accounts (Admin/root) using commonly found passwords
- The shared user database across IPMI, Redfish, and web interfaces means compromising one surface can grant access to all
Why It Matters
This vulnerability exposes a critical blind spot in data center security: management processors that control critical infrastructure are often far less protected than the systems they manage. With modern GPU cracking capabilities and widespread use of predictable factory-issued passwords, a single exposed BMC can become a privileged, difficult-to-detect foothold across an entire management network.
Technical Details
- CVE-2013-4786 exploits the IPMI 2.0 Remote Authentication and Key Privacy (RAKP) protocol, where the BMC returns an HMAC-SHA1 authentication code calculated using the account password and known session values, enabling offline brute-force attacks via UDP port 623
- BMCs provide out-of-band management through multiple surfaces: IPMI protocol, Redfish HTTPS-based API, and web-based administrative interfaces, often sharing the same user database
- Attackers can obtain password hashes without sending a new request per password candidate, making offline cracking significantly more efficient than repeated online login attempts
- Lava's scan identified 37,000 internet-exposed IPMI interfaces, with 24,000+ disclosing pre-login authentication hashes and thousands using weak or default credentials
Industry Insight
- Organizations should immediately audit their IPMI/BMC exposure, restrict UDP port 623 from public access, and enforce strong, unique passwords on all management interfaces
- The shared credential model across IPMI, Redfish, and web UIs means security teams must treat BMC compromise as a full infrastructure takeover risk, not an isolated management plane issue
- Legacy protocols like IPMI 2.0 remain dangerously prevalent; organizations should prioritize migrating to more secure management frameworks and implementing network-level segmentation for out-of-band management traffic
Disclaimer: The above content is generated by AI and is for reference only.