Skip to content
Braincap
← All articles

Over 24,000 servers leak their password hash via BMC (CVE-2013-4786)

by Claudiu Hulea · IT Management Consultant

Illustration of a server management interface (BMC) exposed on the internet

Over 24,000 servers have their BMC management interface exposed on the internet and leak password-derived material (a hash) that an attacker can crack offline. The cause is a nearly 20-year-old protocol weakness (CVE-2013-4786) in IPMI 2.0. The lesson is simple and harsh: management interfaces have no business on the public internet. Below: why it matters and what to do.

In brief

  • What is a BMC? A Baseboard Management Controller — a dedicated processor on the server motherboard that enables remote administration (power on/off, firmware updates, mounting virtual media), independent of the operating system.
  • Scale: 24,650 exposed servers leak password-derived authentication material. The figure comes from the firm Lava, which scanned 36,872 internet-exposed hosts on UDP port 623 (IPMI).
  • The weakness: CVE-2013-4786, an authentication issue in IPMI 2.0 (a protocol from 2004). The CVE is from 2013, but the flaw is a fundamental, protocol-level one.
  • Affected: Supermicro systems, HPE iLO 4 interfaces and generic IPMI 2.0 implementations.
  • Distribution: the US hosts 39% of the vulnerable servers.

How it works

The BMC is a “computer inside the computer” that runs below the operating system and has total control of the physical server. The IPMI 2.0 protocol (RAKP) has a design flaw: on an authentication request, it returns a password-derived hash even to an unauthenticated requester. The attacker captures that response and cracks the password offline, on dedicated GPUs — without touching the server, without tripping any alarm.

And factory passwords don’t help: Lava estimated an HPE default password could be recovered in about one day per captured response on a plain Apple M3 system.

Why it’s serious

  • Total control below the OS. Whoever controls the BMC controls the physical server: firmware, power, virtual media — at a layer antivirus and EDR can’t see.
  • Invisible persistence. A compromise at the BMC/firmware level survives reinstalling the operating system.
  • Amplification in cloud/AI. A single compromised physical server can affect several workloads belonging to several customers.
  • Not easily “patched” — being a protocol weakness, the real fix is isolation and password rotation, not a simple update.

What to do now

  1. Take IPMI, Redfish and the BMC off the public internet. Never exposed directly — this is the single most important step.
  2. Isolated (out-of-band) management network. BMC access only from a separate network, over VPN, not from the production network.
  3. Rotate factory passwords with long, unique ones; never leave default credentials.
  4. Disable legacy IPMI authentication where possible, and prefer safer interfaces.
  5. Scan your own addresses for an exposed UDP port 623 — so you know whether you’re already on the list.

The takeaway

Management interfaces (BMC/IPMI, iLO, iDRAC, Redfish) are the “keys to the kingdom” below the operating system — and exposing them on the internet is one of the worst basic infrastructure mistakes. An IT security audit or a penetration test discovers exactly what you have exposed to the internet, including these interfaces that are easy to forget.

Sources

Frequently asked questions

What is the BMC password-hash leak (CVE-2013-4786)?

Over 24,000 servers have their BMC management interface exposed on the internet and leak password-derived material (a hash) through a protocol weakness in IPMI 2.0 (RAKP): on an authentication request, the protocol returns the hash even to an unauthenticated requester, who then cracks it offline. The flaw is nearly 20 years old.

What is a BMC and why is it serious?

A Baseboard Management Controller is a dedicated processor on the motherboard that enables remote administration independent of the operating system — a "computer inside the computer" that runs below the OS. Whoever controls it controls the physical server (firmware, power, virtual media), at a layer antivirus and EDR can't see, and a compromise survives reinstalling the OS.

Which systems are affected?

Supermicro systems, HPE iLO 4 interfaces and generic IPMI 2.0 implementations. The figure (24,650 servers) comes from the firm Lava, which scanned hosts exposed on UDP port 623. Factory passwords don't help — an HPE default password can be recovered in about one day per captured response.

How do I protect my servers?

Take IPMI, Redfish and the BMC off the public internet (the single most important step), use an isolated out-of-band management network reachable only over VPN, rotate factory passwords with long, unique ones, disable legacy IPMI authentication where possible, and scan your own addresses for an exposed UDP port 623.