BMC and CVE-2013-4786: 24,000 interfaces expose pre-login hashes

A Baseboard Management Controller (BMC) operates even when a server’s operating system is down. It can change firmware, mount virtual media, open a console and power-cycle the host. That makes Lava’s new measurement concerning: of nearly 37,000 internet-visible management interfaces speaking IPMI, more than 24,000 reportedly disclosed material that enables offline password guessing before authentication.

The root is CVE-2013-4786, a consequence of the IPMI 2.0 authentication design introduced in 2004. This is not a new zero-day, and there is usually no single patch that preserves full protocol compatibility. The operational failure is exposing a privileged out-of-band plane to the internet and protecting it with predictable or reused passwords.

Why RAKP reveals guessable material

During the Remote Authenticated Key-Exchange Protocol (RAKP), a BMC returns an HMAC-SHA1 value calculated with the account password and session parameters known to the client. The NVD entry explains that an unauthenticated remote party can obtain this HMAC from the RAKP message 2 response.

The attacker does not receive the password directly. They do receive a value against which candidates can be tested locally without contacting the server again. Account lockout, rate limiting and logs of failed online logins do not observe millions of guesses made on attacker hardware. Modern GPUs make weak choices even less defensible.

Many implementations share a user database across IPMI, Redfish and the web panel. A password recovered through RAKP may therefore open a more convenient HTTPS interface or API, not only UDP port 623.

What the internet measurement found

Lava reports nearly 37,000 public management interfaces using IPMI and more than 24,000 responses that exposed password-derived hashes. Researchers found 6,240 hosts accepting an empty username with a weak password and 2,340 with named accounts such as Admin or root whose passwords appeared in public wordlists.

The company also identified factory password formats with constrained, predictable structure. This does not mean every one of the 24,000 hosts has been compromised or every password is recoverable. The count describes systems that permit offline testing; success depends on the actual secret strength.

Why BMC is a high-value target

BMC compromise sits below normal endpoint controls. An attacker may observe boot, change settings, attach an operating-system image or retain access after OS reinstall. Management traffic often receives less monitoring than production networks, while factory accounts can survive multiple server lifecycles.

Data centres and GPU clusters face additional risk from repeatable configurations. One firewall rule, shared password pattern or cloned management image can expose an entire device batch.

Securing the out-of-band plane

1. Scan your external ranges for UDP 623, Redfish and BMC web panels. Do not rely on address obscurity.
2. Remove BMCs from the internet. Place them in a dedicated management segment reached through an MFA-protected bastion or VPN.
3. Disable IPMI over LAN where it is unnecessary. Prefer correctly configured Redfish over TLS, but do not share a weak account with IPMI.
4. Remove default accounts, generate a unique random password per device and store it in a secrets manager.
5. Update BMC firmware and review cipher, certificate and directory-integration settings.
6. Restrict communication paths and export console-use, firmware-change and account-creation logs away from the BMC.
7. After suspected compromise, do not trust an OS reinstall alone. Verify firmware and the boot chain using the vendor’s recovery procedure.

Apply zero-trust network segmentation and the lifecycle in our secrets management and rotation guide.

Primary facts versus Breachroad analysis

NVD documents the CVE-2013-4786 mechanism. Lava provides its own measurement and password-testing results; SecurityWeek independently covers the research. Public evidence does not show compromise of every discovered system.

Breachroad’s conclusion is to treat BMC as a separate critical identity and monitoring domain. Cybersecurity training for administrators helps teams build secure out-of-band procedures, while an IT security audit can verify exposure, segmentation, accounts and the process for restoring firmware trust.