24,650 BMCs Leak IPMI Password Hashes Before Login — CVE-2013-4784 Still Unpatched

Cybersecurity researchers at Israeli firm Lava have identified more than 36,000 Baseboard Management Controller (BMC) management interfaces exposing the Intelligent Platform Management Interface (IPMI) protocol directly to the public internet. Of those 36,872 internet-exposed server-management interfaces, 24,650 were found to disclose password-derived authentication hashes prior to any login attempt, stemming from a fundamental flaw in the IPMI v2.0 specification itself. According to researcher Michael Katchinskiy, more than 30% of the returned hashes mapped to passwords recoverable via common wordlists and predictable factory chassis-sticker formats, including systems operated by GPU providers running modern Supermicro and HPE servers still using factory-issued credentials.

The root issue is CVE-2013-4786 (CVSS 7.5), a high-severity information disclosure vulnerability that enables remote attackers to extract password hashes for valid accounts and conduct offline brute-force attacks. By obtaining an HMAC from an RMCP+ Authenticated Key-Exchange Protocol (RAKP) message response from a BMC, an attacker can recover weak, reused, factory-set, or predictably formatted passwords without ever authenticating. Dell has issued an advisory noting this is "an inherent problem with the specification for IPMI v2.0" and that no patch exists. Administrators can verify whether their own credentials fall into the vulnerable category using a password strength checker, and can audit exposure of management interfaces on their perimeter with a port scanner targeting UDP/623.

BMCs operate as out-of-band management processors embedded on server motherboards, controlling power, firmware, remote console access, OS installation, and hardware telemetry. Because they run independently of the host operating system, a compromised BMC can bypass traditional endpoint security controls, survive OS reinstalls, and provide attackers with persistent access. Firmware security firm Eclypsium flagged this privileged position as an ideal attack surface in late 2022 and early 2023, warning of its appeal for persistent malware deployment. The situation is now amplified in AI data centers, where a single exposed BMC on shared bare-metal infrastructure could place multiple tenants' workloads at risk through lateral movement, representing a significant blind spot in the AI infrastructure boom.

Recommended mitigations include disabling IPMI v2.0 where possible and falling back to IPMI v1.5, isolating BMC interfaces on dedicated management VLANs, enforcing strong unique passwords, and blocking UDP port 623 at the network perimeter. Organizations should also review any TLS-enabled management endpoints through an SSL/TLS configuration checker to ensure encrypted Redfish or HTTPS-based management consoles are properly hardened against downgrade and interception attacks.