Exposed BMCs hand out password hashes before login

1. Executive summary

CVE-2013-4786, a flaw in the IPMI 2.0 authentication protocol, is actively exposing authentication password hashes from internet-facing Baseboard Management Controllers (BMCs). Research by Lava identified 36,872 exposed BMCs via Shodan, with 24,650 returning password-derived HMAC-SHA1 hashes to unauthenticated clients on UDP port 623. Approximately one-third of captured hashes were recoverable via public wordlists or predictable factory password formats, with Supermicro X13DEM factory passwords crackable in approximately one hour on 8× GPUs and HPE iLO factory passwords in 32 seconds on equivalent hardware. For EMEA financial services, any data centre running Supermicro or HPE servers with BMC interfaces exposed to the internet is at risk of complete host compromise — attackers gain power-cycle, virtual media, remote console, and firmware flash capabilities below the host OS, evading endpoint security tooling entirely.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability: CVE-2013-4786 — a weakness in the IPMI 2.0 authentication handshake (RAKP) that allows an unauthenticated remote attacker to obtain HMAC-SHA1 password hashes before completing authentication. The protocol was introduced in 2004; the CVE was assigned in 2013 but remains unpatched by design in the IPMI 2.0 specification itself.

Attack chain (confirmed from source)

1. Reconnaissance. Attacker scans the public internet for UDP port 623 (IPMI/BMC). Shodan identifies 36,872 responding BMCs. No authentication required to enumerate.
2. Hash extraction. Attacker sends an IPMI 2.0 RAKP message to a target BMC. The BMC returns an HMAC-SHA1 hash computed over the account password and known session values — before the client authenticates. 24,650 of 36,872 exposed BMCs returned this material.
3. Offline cracking. Attacker moves hash cracking offline. A single request covers every password candidate; no repeated login attempts occur, so failed-login detection is ineffective. Approximately one-third of captured hashes were assessed as recoverable.
4. Credential recovery — wordlist route. On 2,340 endpoints, a named account (e.g., ADMIN or root) matched a password in a publicly downloadable wordlist. Many cracked within minutes on the first pass.
5. Credential recovery — factory password route (Supermicro). Supermicro BMCs use a factory password format of exactly 10 uppercase alphabetic letters (~141 trillion candidates). Eight GPUs running Hashcat can exhaust the full keyspace in an estimated one hour. Lava confirmed this against two adjacent X13DEM boards at a US bare-metal GPU provider — both passwords matched the chassis-sticker format and were recovered.
6. Credential recovery — factory password route (HPE iLO). HPE iLO factory passwords use a shorter character set (uppercase letters and digits), yielding a smaller keyspace. A lab server with 8× RTX 6000 PRO cards cracked each captured response in 32 seconds.
7. Empty username route. Roughly one in six exposed hosts responded to an empty username, backed by a weak password.
8. Post-compromise capability. Once authenticated to the BMC, the attacker operates beneath the host OS with full hardware control: power-cycle, virtual media mounting, remote console access, and firmware flashing. Host-based EDR and OS-level monitoring have no visibility into this layer.
9. Persistence. Firmware-level persistence is possible. The source references iLOBleed, a documented rootkit in iLO 4 firmware tied to destructive server attacks, as precedent for BMC-resident malware.

Observed compromise evidence: One exposed iLO 4 login page carried a ransom note in its Security Notice panel claiming RSA-2048 encryption and demanding 0.3 BTC via a disposable email address. Whether disk encryption actually occurred is unconfirmed. The note confirms that at least one attacker reached a management interface and modified its content.

Attribution: No named threat actor is identified in the source material. The iLOBleed reference is to prior research, not current attribution. Attribution is unconfirmed.

Confidence caveat: The exposure counts (36,872 / 24,650), crack rates, and the X13DEM validation are single-sourced to Lava research via Help Net Security and BleepingComputer. The technical mechanism (IPMI 2.0 RAKP hash disclosure) is consistent with the long-documented CVE-2013-4786. Verify exposure counts against your own Shodan/attack-surface data before enforcement.

4. Mitigation & containment

P1 — within 24 hours

• Identify exposed BMCs. Scan all owned and hosted IP ranges for UDP port 623. Any BMC reachable from the internet is a P1 exposure. Use nmap -sU -p 623 --script ipmi-version <range> to enumerate.
• Block UDP 623 at the perimeter. Immediately firewall all BMC/IPMI interfaces from the public internet. BMC access should be restricted to a dedicated management VLAN or out-of-band management network with no internet route.
• Force credential rotation. For any BMC that was or may have been internet-exposed, rotate all BMC credentials immediately. Assume the HMAC-SHA1 hash has been captured. Replace default/factory credentials with strong, randomly generated passwords (minimum 16 characters, mixed case, digits, symbols) that do not match any known factory format.

P2 — within 72 hours

• Audit BMC configurations across the estate. Enumerate all Supermicro, HPE iLO, Dell iDRAC, and other BMC interfaces. Verify: (a) no internet exposure, (b) no default credentials in use, (c) no empty-username accounts enabled, (d) firmware is current.
• Disable IPMI if not required. If BMC/IPMI remote management is not operationally necessary, disable the IPMI service on the BMC interface. Use local or serial console access instead.
• Check for prior compromise. Inspect BMC web interface security notice panels for unauthorised modifications (as observed in the iLO 4 ransom note case). Review BMC firmware integrity. For HPE iLO 4 specifically, check for indicators of iLOBleed rootkit persistence.

P3 — within 7 days

• Implement network segmentation for management interfaces. Enforce a dedicated management network with jump-host access, MFA at the jump host, and full session logging. No BMC should be reachable from any general-purpose corporate or production VLAN.
• Update BMC firmware. Apply the latest firmware from Supermicro, HPE, or the respective vendor. While CVE-2013-4786 is a protocol-level flaw that cannot be patched in IPMI 2.0 itself, vendors may offer mitigations such as configurable RAKP behaviour or enhanced password policies. Supermicro has acknowledged the report and indicated it will examine longer password formats.
• Review third-party hosting contracts. For colocation, bare-metal, and IaaS providers, require contractual assurance that BMC interfaces are not internet-exposed and that factory credentials have been rotated. This engages DORA Art. 28 obligations.

5. Indicators of compromise

No atomic indicators of compromise (IP addresses, domains, file hashes, email addresses) are provided in the source material. The ransom note observed on one iLO 4 interface demanded 0.3 BTC via a disposable email address, but the specific email address and BTC wallet are not disclosed.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material does not provide specific file hashes, command-line strings, mutex names, registry keys, or network signatures beyond the general IPMI/UDP 623 protocol behaviour. A network-level detection for unauthenticated RAKP responses on UDP 623 would require custom Snort/Suricata rule authoring based on the IPMI 2.0 specification, which is beyond what the source artefacts support.

7. Sources

• Help Net Security — "Exposed BMCs hand out password hashes before login" — https://www.helpnetsecurity.com/2026/07/28/exposed-bmc-ipmi-vulnerability-research/ — 2026-07-28
• BleepingComputer — "Over 24,000 exposed server BMCs leak password hash via decades-old flaw" — https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/ — 2026-07-28

8. Adverse Trace position

This is a high-severity exposure for any EMEA financial services organisation running physical server infrastructure with BMC/IPMI interfaces. CVE-2013-4786 is a known, unpatchable protocol-level flaw — the risk is not theoretical, and the source confirms active exploitation evidence (ransom note on an iLO 4 interface). The attack bypasses all host-layer security controls and grants the attacker hardware-level persistence that survives OS rebuilds. The factory password formats used by Supermicro (10 uppercase letters) and HPE iLO (shorter alphanumeric) provide trivially small keyspaces for modern GPU arrays. Immediate action: identify and block all internet-exposed BMC interfaces, rotate all BMC credentials, and verify no prior compromise has occurred. Adverse Trace will monitor for additional exposure data and any emerging BMC-focused campaign activity. The exposure counts and crack-rate statistics are single-sourced to Lava research — clients should validate against their own attack-surface management telemetry.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.