Recent findings have raised alarms in the cybersecurity community due to the discovery of over 36,000 Baseboard Management Controller (BMC) interfaces exposing the Intelligent Platform Management Interface (IPMI) protocol to the internet. Of these, a concerning 24,650 are leaking password hashes before login, attributed to a flaw in the IPMI v2.0 protocol, as reported by Lava to The Hacker News.
Vulnerability Details and Impact
The vulnerability, known as CVE-2013-4786, carries a CVSS score of 7.5, indicating high severity. This flaw allows attackers to extract password hashes for offline guessing attacks via the HMAC from an RMCP+ Authenticated Key-Exchange Protocol (RAKP) message response. Despite being inherent in IPMI v2.0, introduced in February 2024, no patch exists, as confirmed by Dell.
Security researcher Michael Katchinskiy highlighted that over 30% of the exposed hashes could be broken using common wordlists, impacting modern servers from Supermicro and HPE that still use default passwords. The issue is exacerbated in AI data centers, where exposed BMCs can jeopardize multiple tenants’ workloads due to shared infrastructure risks.
Technical Insights and Threat Landscape
BMCs, critical for managing server hardware, operate independently via protocols like IPMI and Redfish. This independence, known as Out-of-Band management, allows attackers who compromise BMCs to bypass typical security controls and maintain persistent access, even after system reinstallation.
Research indicates that 36,872 IPMI services were exposed on UDP port 623 as of May 6, 2026, with significant concentrations in the U.S., Germany, China, the Netherlands, and the U.K. Alarmingly, nearly 25,000 of these systems exposed authentication materials, facilitating offline credential attacks.
Preventive Measures and Recommendations
To mitigate these risks, security experts recommend blocking UDP port 623 at the network perimeter, rotating factory passwords during provisioning, and restricting BMC access to private management networks. Additionally, disabling legacy IPMI versions and implementing network access controls are crucial steps.
Yakir Kadkoda, CTO of Lava, emphasized the urgent need to secure these management layers as AI infrastructure expands. Organizations have focused on hardening cloud systems but must now prioritize the underlying management controllers to prevent stealthy and persistent cyber threats.
In conclusion, while CVE-2013-4786 is not new, the threat landscape has evolved, making each exposed server a valuable target for attackers. This necessitates proactive security measures to safeguard critical infrastructure.
