22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking

Summary

Researchers have discovered that a 22-year-old vulnerability in the IPMI protocol (CVE-2013-4786) is exposing over 24,000 internet-facing servers. The flaw allows attackers to obtain password-derived authentication data, enabling offline password cracking. Many of these exposed systems used weak, default, or easily guessable factory passwords.

Full text

Security22-Year-Old IPMI Flaw Exposes 24,000 Servers to Offline Password Cracking Researchers found 24,650 public BMC interfaces leaking IPMI password hashes, exposing servers to offline password cracking through a decades-old protocol flaw. byWaqasJuly 29, 20263 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening A server management feature designed to work when a computer’s operating system is unavailable is exposing password-derived authentication data on thousands of internet-facing systems, according to new research from Lava. Researchers identified 36,872 publicly accessible Baseboard Management Controller (BMC) interfaces using the Intelligent Platform Management Interface (IPMI). Of those, 24,650 returned password-derived authentication data without requiring successful authentication. BMC Access Gives Extensive Control Over Servers A BMC is a small management computer built into a server’s motherboard. Administrators use it to restart machines, open remote consoles, install operating systems, update firmware, and inspect hardware, even when the main server is switched off or unresponsive. Those capabilities make exposed BMC interfaces high-value targets. Someone who obtains valid login credentials may be able to control the physical server from outside its operating system, where endpoint security software has limited visibility. Lava traced the exposure to CVE-2013-4786, a weakness in IPMI 2.0 authentication. The protocol was introduced in 2004, while the vulnerability received its CVE identifier in 2013. When an attacker starts an authentication request, a vulnerable BMC returns a cryptographic response derived from the account password. The response does not reveal the password in readable form, but it allows password guesses to be tested offline without repeatedly contacting the server. Weak and Factory Passwords Were Recovered Weak credentials made many of the captured responses practical to crack. Lava found 6,240 controllers that accepted an empty username and produced authentication data matching a weak password during offline testing. Another 2,340 systems had named accounts, including ADMIN or root, whose passwords matched entries in public password dictionaries. Researchers said many of these passwords were recovered within minutes. Factory credentials were also vulnerable even when each server had received a different password. Some Supermicro systems use ten uppercase letters printed on a chassis sticker, while certain HPE iLO systems use eight uppercase letters and numbers. Knowing these fixed formats reduces the number of password combinations that need to be tested. During authorized testing, Lava recovered factory-format passwords for two modern Supermicro servers operated by a GPU provider. Researchers did not use the passwords to log in or alter the systems, and the provider removed the exposure after being notified. Lava also reproduced the attack on an HPE server in its own laboratory. The full research says more than 30% of the returned hashes were associated with passwords recoverable through common wordlists or predictable factory formats. Shodan results (Image via Lava) In a comment to Hackread.com, ThreatDown cybersecurity evangelist Mark Stockley said BMC security is difficult to manage because the controllers are built into motherboards, firmware procedures differ between vendors, and maintenance can interrupt remote access to important systems. He noted that the flaw comes from the IPMI protocol itself, leaving operators without one universal update that fixes every implementation. Public IPMI Access Should Be Removed Lava researchers recommend blocking public access to UDP port 623 and placing BMC interfaces on private management networks reachable only through a VPN, bastion host, or approved administrative system. They also recommend replacing factory credentials, disabling anonymous accounts and weak IPMI options, applying vendor firmware updates where available, and monitoring management networks separately from normal server traffic. Because CVE-2013-4786 stems from the IPMI 2.0 authentication protocol itself, mitigation may require disabling IPMI over LAN or restricting access rather than relying on a software patch alone. Waqas I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cybersecurity and tech world. I am also into gaming, reading and investigative journalism. View Posts 22-Year-Old IPMI Flaw Exposes 24K Servers to Offline Password CrackingBMCCybersecurityIPMILavaPasswordVulnerability Leave a Reply Cancel reply View Comments (0) Related Posts Read More Cyber Attacks Security Human rights watchdog ‘Karapatan’ hit by weeks long DDOS attacks The official website of Karapatan has been suffering a series of DDoS attacks since July 29th and are still ongoing as of yesterday, August 18th. byWaqas Read More Microsoft Phishing Scam Security Fake Microsoft Teams Billing Phishing Alerts Reach 6,135 Users via 12,866 Emails Scammers are abusing Microsoft Teams invitations to send fake billing notices, with 12,866 emails reaching around 6,135 users in a phone-based phishing campaign. byDeeba Ahmed Read More Security Malware GravityRAT malware evades detection and targets users in India The updated version of GravityRAT malware evades detection by checking the current CPU temperature – It is believed… byWaqas Read More Security Malware Scams and Fraud Hackers Hijack JDownloader Site to Deliver Malware Through Installers JDownloader confirms a security breach where hackers manipulated official download links to distribute malicious files between 6 and 7 May 2026. byDeeba Ahmed

Indicators of Compromise

• cve — CVE-2013-4786

Entities