“More than 30% of the returned hashes were associated with passwords that could be recovered using common wordlists and predictable factory chassis‑sticker formats,” security researcher Michael Katchinskiy warned — a finding that underpins a far broader exposure of server management hardware to the public internet.
CVE-2013-4786 and the limits of IPMI v2.0
At the center of the disclosure is CVE-2013-4786 (CVSS 7.5), an information‑disclosure flaw described in new research shared by Lava and reported by The Hacker News. The vulnerability allows an unauthenticated remote party to obtain password‑derived authentication material — specifically an HMAC — from a BMC during the IPMI authentication exchange. Dell, in an advisory cited by the researchers, described the problem as “an inherent problem with the specification for IPMI v2.0,” and noted there is no patch.
The specification at issue, IPMI v2.0, was introduced in February 2024, and Lava summarized the situation bluntly: “CVE‑2013‑4786 is not new, but the risk around it has changed.” GPU‑accelerated cracking and the rising value of exposed bare‑metal infrastructure have, the company says, materially increased attacker incentives.
How exposed BMCs leak authentication material
Researchers explain the technical mechanics plainly. During the Remote Management Control Protocol+ (RMCP+) Authenticated Key‑Exchange Protocol (RAKP) step, a BMC can return an HMAC‑SHA1 authentication code that is calculated using the account password and session values known to the requester. As Michael Katchinskiy put it, “An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline. Unlike repeated online login attempts, the offline process does not require a new request to the BMC for every password candidate.”
The offline nature of that attack is critical: modern GPU hardware can test large password candidate lists rapidly, and Lava’s tests found HPE iLO factory passwords recoverable within a minute and Supermicro factory passwords recoverable in approximately one hour.
Scale and geography: tens of thousands of exposed management interfaces
As of May 6, 2026, an internet scan found 36,872 unique hosts exposing IPMI services on UDP port 623. Of those, 24,650 were observed to disclose password‑derived authentication materials before login — allowing offline credential cracking. More than 14,000 of the exposed systems are located in the United States; the remaining hosts are concentrated in Germany, China, the Netherlands, and the United Kingdom.
Drilling into the weak‑credential problem, Lava reported that 6,240 BMCs returned authentication material for an empty username that matched a weak password candidate, and another 2,340 BMCs returned authentication material for named accounts such as ADMIN or root that matched passwords from publicly available wordlists. Lava also noted that modern Supermicro and HPE servers operated by GPU providers were affected, and that some systems still used factory‑issued passwords.
Vendor reactions and attacker activity
Dell’s advisory characterizes the flaw as inherent to the IPMI v2.0 specification and says there is no patch. Supermicro told researchers it will “evaluate possible improvements to the default password policy for future hardware revisions.” The report also called out HPE iLO servers: Lava cited evidence of threat actors already targeting internet‑exposed BMC interfaces, including a ransomware operator leaving an extortion note on an HPE iLO 4 login page; the report states it is not clear who was behind that activity. The report also recalls prior incidents, noting HPE iLO servers have been singled out in the past to deploy a rootkit called iLOBleed.
Mitigations and practical steps for operators
- Block UDP port 623 at the network edge to prevent unauthenticated remote requests to IPMI services.
- Rotate factory‑issued passwords during provisioning and avoid predictable chassis‑sticker formats that facilitate wordlist recovery.
- Disable legacy or weak protocols such as IPMI 1.5 when possible, and prefer more modern management interfaces where available.
- Restrict BMC access to a dedicated private management network and apply network access controls so only approved administrative systems can reach BMC interfaces.
Those steps reflect the countermeasures explicitly advised in the Lava report and in vendor guidance cited by researchers.
What this means for technologists, procurement leaders, and cloud/GPU providers
- Technologists and security teams: Systems with exposed BMCs present a persistent, hard‑to‑detect foothold because BMCs operate out‑of‑band and survive operating system reinstalls. Teams should prioritize network isolation and credential rotation for BMCs.
- Procurement leaders and hardware vendors: The persistence of factory passwords and predictable defaults is a practical risk; Supermicro’s stated intent to evaluate default password policies signals one vendor response, but Dell’s assessment that the issue is specification‑level raises questions about longer‑term remediation and purchasing decisions.
- Cloud and GPU providers operating bare‑metal environments: The report calls out modern AI data centers where bare‑metal hosts are valuable targets; Lava warned that a single exposed BMC “can potentially place multiple organizations’ workloads at risk through shared infrastructure or lateral movement.”
Two threads run through this disclosure: a longstanding protocol design that can leak secrets during authentication, and a changed operational environment where exposed bare‑metal and GPU‑backed services are high‑value targets that can be attacked rapidly with modern cracking hardware. Vendors and operators can take immediate network and password‑management steps; what remains uncertain in the source material is whether specification‑level changes or broadly deployed mitigations will follow.
https://thehackernews.com/2026/07/24650-internet-exposed-bmcs-disclose.html
