24,650 Internet-Exposed BMCs Disclose IPMI Password Hashes Before Login

A 20-Year-Old Weakness in IPMI 2.0 Exposed Over 24,000 BMCs to Password Hash Disclosure Attacks

The vulnerability in question is CVE-2013-4786, a high-severity information disclosure flaw that enables remote attackers to obtain password hashes for valid accounts and conduct offline password guessing attacks by obtaining the HMAC from an RMCP+ Authenticated Key-Exchange Protocol (RAKP) message response from a BMC. This issue is inherent to the IPMI v2.0 specification itself, and there is no patch available.

Per an advisory released by Dell, "this is an inherent problem with the specification for IPMI v2.0," with the PC maker noting that there is no patch. "More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis-sticker formats," security researcher Michael Katchinskiy said.

BMCs are specialized management processors embedded on a server's motherboard that control power, firmware, remote console access, operating system installation, and system recovery. They also act as a crucial component for remote data center automation and uptime to monitor hardware telemetry and facilitate mass deployment of firmware updates and BIOS configurations.

To bridge remote commands to the hardware, the BMC typically communicates using protocols like IPMI and Redfish. As highlighted by firmware security company Eclypsium in late 2022 and early 2023, the privileged position enjoyed by BMCs can also make them ideal attack targets for bad actors looking to gain remote control and deploy persistent malware.

Because BMCs run completely independently of the host operating system, a mechanism known as Out-of-Band (OOB) management, an attacker who manages to successfully compromise an exposed BMC can sidestep traditional security controls, survive operating system reinstalls, and maintain access.

At the heart of the research is CVE-2013-4786, a 20-year-old weakness in IPMI 2.0, which an attacker can exploit to recover weak, reused, factory-set, or predictably formatted passwords. "During the authentication process, the BMC can return a message response containing an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester," Katchinskiy explained.

"An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline. Unlike repeated online login attempts, the offline process does not require a new request to the BMC for every password candidate," he added.

As of May 6, 2026, a search of the public internet for IPMI services exposed on UDP port 623 uncovered 36,872 unique hosts, of which more than 14,000 are located in the U.S. The remaining systems are concentrated in Germany, China, the Netherlands, and the U.K.

Further analysis has determined that nearly 25,000 exposed password-derived authentication materials before login, allowing offline credential cracking. Perhaps even more concerningly, a total of 6,240 BMCs returned authentication material for an empty username that matched a weak password candidate and another 2,340 BMCs returned authentication data for a named account such as ADMIN or root that matched a password from publicly available wordlists.

In tests conducted by Lava, HPE iLO factory passwords were recoverable within a minute using modern GPU hardware, while Supermicro factory passwords were recoverable in approximately one hour despite being uniquely assigned to each server.

In response to the findings, Supermicro said it will evaluate possible improvements to the default password policy for future hardware revisions.

"CVE-2013-4786 is not new, but the risk around it has changed," Lava said. GPU cracking has made offline password recovery faster, while modern AI and bare-metal environments have made each exposed server more valuable.

On top of that, evidence has emerged that threat actors are already targeting internet-exposed BMC interfaces, including ransomware operators leaving an extortion note on an HPE iLO 4 login page. It's not clear who is behind the activity.

That said, HPE iLO servers have been singled out as far back as 2020 to deploy a rootkit called iLOBleed. To counter the risk, it's advised to block UDP port 623 at the network edge, rotate factory-issued passwords during provisioning, disable legacy or weak options such as IPMI 1.5, restrict BMC access to a dedicated private management network, and apply network access controls to ensure only approved administrative systems can reach BMC interfaces.

"Organizations have spent years hardening cloud workloads and operating systems, but many have overlooked the infrastructure that sits beneath them," said Yakir Kadkoda, CTO and co-founder at Lava, in a statement.

"These management controllers hold the keys to servers and data centers. Once compromised, attackers can operate beyond the reach of traditional security controls, making this a significant blind spot in the infrastructure underpinning the AI data center boom," he added.